https://issues.shibboleth.net/jira/browse/SSPCPP-493

[shibboleth/cpp-sp.git] / configs / apache2.config.in

diff --git a/configs/apache2.config.in b/configs/apache2.config.in
index ee373bd..b167a51 100644 (file)
--- a/configs/apache2.config.in
+++ b/configs/apache2.config.in
@@ -1,52 +1,50 @@
-# ADD THIS TO THE END OF YOUR APACHE'S HTTPD.CONF
+# https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
 
-######
-## SHIB Config
-######
+# RPM installations on platforms with a conf.d directory will
+# result in this file being copied into that directory for you
+# and preserved across upgrades.
+
+# For non-RPM installs, you should copy the relevant contents of
+# this file to a configuration location you control.
 
 #
-# Load the Apache Request module and then the SHIBBOLETH module
-# Note that ORDER MATTERS!  Apache runs the modules in the
-# _reverse_ order that modules were loaded.  The Shib module
-# depends on the Apreq module, so you need this load-order
-# to make sure they are run properly.
-#
-# If you see log messages about missing apreq symbols then you
-# have messed this up.
+# Load the Shibboleth module.
 #
-LoadModule apreq_module /opt/shibboleth/libexec/mod_apreq.so
-LoadModule mod_shib /opt/shibboleth/libexec/mod_shib.so
+LoadModule mod_shib @-PKGLIBDIR-@/mod_shib_20.so
 
 #
-# Global SHIRE Configuration
-# This is the INI file that contains all the global, non-apache-specific
-# configuration.  Look at this file for most of your configuration
-# parameters.
+# Ensures handler will be accessible.
 #
-SHIBConfig /opt/shibboleth/etc/shibboleth/shibboleth.ini
+<Location /Shibboleth.sso>
+  Satisfy Any
+  Allow from all
+  AuthType None
+  Require all granted
+</Location>
 
 #
-# Configure a test directory
+# Used for example style sheet in error templates.
+#
+<IfModule mod_alias.c>
+  <Location /shibboleth-sp>
+    Satisfy Any
+    Allow from all
+    AuthType None
+    Require all granted
+  </Location>
+  Alias /shibboleth-sp/main.css @-PKGWEBDIR-@/main.css
+</IfModule>
+
 #
-# You need _at least_ a "require" option for Shib to take effect for this
-# directory.  You can either set the AuthType to "shibboleth", or you can
-# turn on ShibBasicHijack. For Shib, valid-user is a somewhat vague concept
-# and only means that a trusted origin site has authenticated the user, but
-# doesn't mean that any attributes were received.
+# Configure the module for content.
+#
+# You MUST enable AuthType shibboleth for the module to process
+# any requests, and there MUST be a require command as well. To
+# enable Shibboleth but not specify any session/access requirements
+# use "require shibboleth".
 #
 <Location /secure>
   AuthType shibboleth
-  require affiliation ~ ^member@.+$
-  # require valid-user
-
-  # Per-directory SHIRE Configuration
-  #ShibBasicHijack On
-  #ShibSSLOnly On
-  #ShibAuthLifetime 14400
-  #ShibAuthTimeout 3600
-
-  # RM Configuration
-  #DisableRM On
-  #AuthGroupFile /foo
-  #ShibExportAssertion On
+  ShibRequestSetting requireSession 1
+  require valid-user
 </Location>