From 197a42c32b0eb9ff87149b8ee8c1c68d7a7ebdfc Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Oct 25 2016 19:10:34 +0000
Subject: Allow either mod_ssl or mod_nss to mark as SSL being used, regardless of enabled module


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/templates/install/idp.conf b/templates/install/idp.conf
index 9a12b43..a2873b5 100644
--- a/templates/install/idp.conf
+++ b/templates/install/idp.conf
@@ -14,12 +14,9 @@ ${wsgi_socket}
 
 <Location ${script_alias}>
     WSGIProcessGroup ${instance}
-    ${ssl_require}<IfModule mod_nss.c>
-    ${ssl_require}    NSSRequireSSL
-    ${ssl_require}</IfModule>
-    ${ssl_require}<IfModule !mod_nss.c>
-    ${ssl_require}    SSLRequireSSL
-    ${ssl_require}</IfModule>
+    ${ssl_require}RewriteEngine on
+    ${ssl_require}RewriteCond %{HTTPS} !=on
+    ${ssl_require}RewriteRule ^/?(.*) https://%{SERVER_NAME}/$$1 [R,L]
 </Location>
 
 <Directory ${ipsilondir}>
diff --git a/templates/install/saml2/sp.conf b/templates/install/saml2/sp.conf
index 075f700..727cd13 100644
--- a/templates/install/saml2/sp.conf
+++ b/templates/install/saml2/sp.conf
@@ -10,12 +10,6 @@
     MellonVariable "saml-sesion-cookie"
     # Comment out the next two lines if you want to allow logins on bare HTTP
     MellonsecureCookie ${saml_secure_on}
-    ${ssl_require}<IfModule mod_nss.c>
-    ${ssl_require}    NSSRequireSSL
-    ${ssl_require}</IfModule>
-    ${ssl_require}<IfModule !mod_nss.c>
-    ${ssl_require}    SSLRequireSSL
-    ${ssl_require}</IfModule>
     MellonUser "NAME_ID"
     MellonIdP "IDP"
     MellonSessionLength 3600
@@ -27,21 +21,7 @@
 ${saml_auth}
 
 ${sp}Alias /protected /usr/share/ipsilon/ui/saml2sp
-${sp}
 ${sp}<Directory /usr/share/ipsilon/ui/saml2sp>
-${sp}    <IfModule mod_nss.c>
-${sp}        NSSRequireSSL
-${sp}    </IfModule>
-${sp}    <IfModule !mod_nss.c>
-${sp}        SSLRequireSSL
-${sp}    </IfModule>
-${sp}  <IfModule mod_authz_core.c>
-${sp}    Require all granted
-${sp}  </IfModule>
-${sp}  <IfModule !mod_authz_core.c>
-${sp}    Order Allow,Deny
-${sp}    Allow from All
-${sp}  </IfModule>
 ${sp}</Directory>
 
 # Redirect requests to the secure port