cleanup readme, apache conf (#647)

Author: simonLeary42

README.md

@@ -58,13 +58,16 @@ See the Docker Compose environment (`tools/docker-dev/`) for an (unsafe for prod
        - `npm install`
        - `npx copy-files-from-to`
    - `httpd` `DocumentRoot` set to `webroot/`
-   - `httpd` Authentication
-     - Any authentication will do as long as it defines `REMOTE_USER`, `givenName`, `sn`
+   - `httpd` Authentication:
+     - Unity uses Shibboleth SP and the Apache Shibboleth module (`apt install shibboleth-sp-utils libapache2-mod-shib` on Ubuntu)
+     - Auth must define `$_SERVER["REMOTE_USER"]`, `$_SERVER["givenName"]`, `$_SERVER["sn"]` variables
        - `REMOTE_USER` must take the form `username@org`
        - `givenName` is first name, `sn` is last name
        - `mail` attribute is preferred, but `REMOTE_USER` will be used as an email address if `mail` is absent
-     - Unity uses Shibboleth SP and the Apache Shibboleth module (`apt install shibboleth-sp-utils libapache2-mod-shib` on Ubuntu)
-   - `httpd` Authorization
+     - Auth must accept only the domain name(s) configured by the administrator
+      - this is required because `$_SERVER["HTTP_HOST"]` is trusted internally
+      - in Shibboleth SP, we enforce this using the `redirectLimit` setting
+   - `httpd` Authorization:
      - Restricted access to `webroot/admin/`
      - Global access (with valid authentication) to `webroot/`
      - IP-based access (no authentication) to `lan/`

resources/lib/UnityHTTPD.php

@@ -41,6 +41,7 @@ public static function die(?string $x = null): never
     public static function redirect(?string $dest = null): never
     {
         $dest ??= getRelativeURL($_SERVER["REQUEST_URI"]);
+        // TODO check $_SERVER["REDIRECT_STATUS"]?
         header("Location: $dest");
         http_response_code(302);
         if (CONFIG["site"]["enable_redirect_message"]) {

tools/docker-dev/web/unity-apache.conf

@@ -1,6 +1,4 @@
 <VirtualHost _default_:80>
-    ServerName account-portal-docker-web
-    UseCanonicalName On
     DocumentRoot /var/www/unity-web-portal/webroot
     <LocationMatch '^/(panel|admin)'>
         AuthType Basic