Why does enabling cleartrust override my shibboleth settings in Apache?

Question

I want to protect one of my virtual hosts with shibboleth and others with cleartrust, but as soon as I enable cleartrust I can access the shibboleth protected virtual hosts without being authorized.

This is my shibboleth virtual host:

localhost.virtual-host.conf

<VirtualHost *:443>
    ServerName localhost
    SSLEngine on
    SSLProtocol all
    SSLCertificateFile conf/localhost.crt
    SSLCertificateKeyFile conf/localhost.key
    SSLCertificateChainFile "conf/localhost.crt"
    ErrorLog "logs/localhost-error_log"
    CustomLog "logs/localhost-access_log" common
    ProxyPreserveHost On

    ProxyPass "/Shibboleth.sso" !
    <Location />
        AuthType shibboleth
        Require shibboleth
        ShibRequestSetting applicationId localhost-saml
    </Location>
    <Location /group>
        ShibUseHeaders On
        AuthType shibboleth
        ShibRequestSetting requireSession 1
        ShibRequestSetting applicationId localhost-saml
        Require valid-user
    </Location>
    <Location /Shibboleth.sso>
        Satisfy Any
        Allow from all
    </Location>
</VirtualHost>

My cleartrust httpd.conf

ct-httpd.conf

#
# This is a RSA Access Manager Agent 5.0 configuration file
#

# Load and add the ClearTrust authorization module.
# For Apache 1.3, it should be the last one added (the first one
# to be invoked by Apache)
#
LoadModule ct_auth_module /opt/rsa-axm/agent-50-apache/lib/libct_apache24_agent.so

<IfModule ct_apache_mod.c>

  # Where the agent configuration is located:
  CTAgentRoot /opt/rsa-axm/agent-50-apache/webservers/Apache_2.2.15

  # Where the ClearTrust forms are located.  This directory must
  # always be configured for authentication, so the ClearTrust module
  # can intercept and handle the requests.
  #
  Alias /cleartrust/ "/opt/rsa-axm/agent-50-apache/htdocs/"
  <Directory "/opt/rsa-axm/agent-50-apache/htdocs/">
    AuthType Basic
    Require valid-user
    AuthName CT
    Order allow,deny
    Allow from all
  </Directory>

  # Any part of a web site to be protected by ClearTrust must be
  # configured for authentication.  See the Apache documentation
  # for details.
  #
  # This example will make ClearTrust protect the entire web site,
  # unless there are previous Location overriding directives.
  #
  <Location />
    AuthType Basic
    Require valid-user
    AuthName CT
  </Location>

</IfModule>

My cleartrust webagent.conf, by default I disable cleartrust, because I want shibboleth to be used by default instead.

webagent.conf

<VirtualHost address=* name=* port=*>
    cleartrust.agent.enabled=False
</VirtualHost>

The problem is that when the contents of ct-httpd.conf are loaded into Apache, thus enabling cleartrust, then I can access /group in localhost without authorizing via shibboleth, which I do not want.

Have anyone else had a similar issue and knows how to fix this? Thanks in advance! :)

Answer 1

After reading through the Access Manager documentation I found that if cleartrust agent is disabled, it also ignores all other potential authentication modules loaded into Apache by default. In order for Access Manager to pass the authentication to other modules, you must specify a list of authentication realms for which the Access Manager Agent allows requests to be evaluated by other modules.

I achieved this by adding this to my webagent.conf file: cleartrust.agent.apache.pass_realms=*

Final result:

webagent.conf

<VirtualHost address=* name=* port=*>
    cleartrust.agent.enabled=False
    cleartrust.agent.apache.pass_realms=*
</VirtualHost>