Shibboleth Developers

[Scott Cantor <>]

> In my port to Apache2 I'm seriously considering a return to a 
> single plugin module.  It appears that about 50% of the code 
> in mod_shire and mod_shibrm is duplicated, and much of the 
> configuration wonkiness was due to the module split.  I think 
> it would be easier to code AND easier to administer if it 
> were returned to a single module.

At this point, I'm personally inclined to agree. I actually think that if we
want to support pluggable RM functionality, we might be better served doing
it ourselves via some kind of simple interface called from the "base" RM in
the module. I think it's potentially more portable to other environments
that way, too.

> I could always add a ShibRM=Off directive to turn off the RM 
> processing for sites that want to do it themselves (to retain 
> the same functionality as not using mod_shibrm)

Note that mod_shibrm does two things...exports attributes and enforces
htaccess. The former seems like a given to me. W/o it, why even use
mod_shire? Eventually we might have other ways of getting attributes via a
library, but the shire module itself is worthless as an Apache plugin w/o
that functionality coming from somewhere. The piece for htaccess files might
be just the opposite of your suggestion...turn it on if you want it.

-- Scott

------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--