Re: [modwsgi] Suggestion and question for wsgi+django + Shibboleth

[Graham Dumpleton]

What is the handler name for mod_shib?

Try using something like:

<Location /Shibboleth.sso>
SetHandler shib
</Location>

Replacing 'shib' with actual handler name for mod_shib.

If fake Alias works then may even be possible to do:

<Location /Shibboleth.sso>
SetHandler default-handler
</Location>

What mod_wsgi does is more aligned with the way things are meant to be
done with Apache. That is, works with Alias/AddHandler/SetHandler. If
mod_shib doesn't and always assumes that one URL, it is mod_shib which
is technically not a good Apache citizen. It should allow a way of
forcing a specific URL rather than just taking a fixed one over if
nothing else uses it.

Even then, one can get module order precedence issues. In that case
you may have to change the order of the LoadModule lines for mod_shib
and mod_wsgi to get things working.

Anyway, don't have time right now to look at mod_shib, but if you
provide me URL to where the source code for it is located, maybe be
able to look at it in next couple of days.

Graham

On 15 September 2012 23:25, Jason Bau <jaso...@gmail.com> wrote:
> Hi,
>
> I'm trying into integrate Shibboleth and Django running on WSGI. Briefly,
> Shib relies on an apache module that basically lays claim to the
> /Shibboleth.sso URL path, e.g.
> http://your.domain.tld/Shibboleth.sso/Metadata hosts your server's metadata,
> etc. But of course, django recommends the practice of setting
> WSGIScriptAlias / "/path/to/djanog.wsgi" in apache. So, my accesses to
> /Shibboleth.sso were getting re-routed to wsgi_module instead mod_shib. In
> fact, using this WSGI alias at the root there was no path where I could
> configure the shibboleth URL path to avoid wsgi_module, but this was of
> course the most convenient way to serve django without having to move a
> facsimile of urls.py into apache location directives.
>
> So, although Alias directive allows serving static paths to take precedence
> over WSGIScriptAlias, it would still be nice to specify an opt-out of
> WSGIScriptAlias processing for a path under the specified one, in this case
> to hand the path over to another module. Does such an option exist?
>
> BTW I was able to find a work-around, which is to set 'Alias /Shibboleth.sso
> /tmp', while Alias taking precedence over WSGIScriptAlias and Shib taking
> precedence over the static file. But this solution feels dirty to me, so
> I'd really appreciate any opinions on the right way to do this, and whether
> this might make a reasonable feature request for the wsgi_module
> maintainers.
>
> Thanks,
> Jason
>
> --
> You received this message because you are subscribed to the Google Groups
> "modwsgi" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/modwsgi/-/rKD1cipYe_MJ.
> To post to this group, send email to mod...@googlegroups.com.
> To unsubscribe from this group, send email to
> modwsgi+u...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/modwsgi?hl=en.

[Jason Bau]

Thanks for your help, Graham.  The SetHandler shib directive indeed worked.

Configuring the URL paths for Shibboleth handlers is done within the shibboleth configuration /etc/shibboleth2.xml and not within any Apache config files.  You'd know more than I whether this is good or bad citizenship in the Apache mod ecosystem.  At the very least, it was confusing to me, and I'll try to add some notes to their wiki regarding this.

Jason