Currently the 8.x-1.x version of the module only checks for the "access administration pages" on its administration pages. Many sites may use this permission to give trusted, but non-advanced, users access to manage content. The settings on the shib_auth admin page can have site-wide ramifications to user logins, potentially allowing users to disable proper authentication. The shib_auth admin pages should have their own independent permissions check in the same way that the module functions in the 7.x-4.x branch.

I've attached a simple patch that defines the new permission (based on the 7.x version), and adds it to the admin page routing.

Comments

pkozik created an issue. See original summary.

steven jones’s picture

Status: Active » Reviewed & tested by the community

Looks good to me!