Require cas-attribute not work for rewrited url

[chrislywhkust]

require cas-attribute won't work for rewrite url

e.g.,

.htaccess

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

It rewrite everything to index.php. If the directory is protected by require cas-attribute, Apache will deny the access.

The workaround is using SAMLValidate instead.

Following patch could help even not using SAMLValidate:

diff --git a/src/mod_auth_cas.c b/src/mod_auth_cas.c
index a3c5561..48bd846 100644
--- a/src/mod_auth_cas.c
+++ b/src/mod_auth_cas.c
@@ -2305,6 +2305,10 @@ int cas_authenticate(request_rec *r)
 				return HTTP_MOVED_TEMPORARILY;
 			}
 
+                        if(!isValidCASCookie(r, c, cookieString, &remoteUser, &attrs)) {
+                           remoteUser = NULL;
+                        }
+
 			if (c->CASDebug)
 				ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "recycling user '%s' from initial request for sub request", remoteUser);
 		} else if(!isValidCASCookie(r, c, cookieString, &remoteUser, &attrs)) {

[dhawes]

You'll need to provide more config so this can be reproduced.