<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" /> <base href="https://issues.shibboleth.net/jira" />
<title>Message Title</title>
</head>
<body class="jira" style="color: #333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<!-- header here -->
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-a19459d7-05ec-47ec-9405-68cfbbfa3b42" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top" />
</td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="rdw@iay.org.uk" id="email_rdw@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=rdw%40iay.org.uk" style="color:#3b73af;; color: #3b73af; text-decoration: none">Rod Widdowson</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-694" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-6a865f4e-95f5-45c1-8202-37d24e8966a4" height="16" width="16" border="0" align="absmiddle" alt="New Feature" /> SSPCPP-694</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 15px; background-color: #fff; border-left: 1px solid #ccc; border-top: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly">
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-694" style="color: #3b73af; text-decoration: none">Re: Native IIS7+ module/filter</a> </span>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff; border-bottom: none; padding-bottom: 0">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0">
<h3 style="margin: 10px 0 0 0; font-size: 16px; line-height: 1.563; margin: 30px 0 0 0"><a name="Status%28mostlyformybenefit%29" style="color: #3b73af; text-decoration: none"></a>Status (mostly for my benefit)</h3>
<p style="margin: 10px 0 0 0">I have a dll that is semi-functional end to end (Status, login, variables set, check session for attributes). So I’m 50% done I’d guess. <br /> The handler (/Shibboleth.sso) runs at <tt>RQ_BEGIN_REQUEST</tt> and the filter (AuthN, AuthZ, exports) runs at <tt>RQ_PRE_EXECUTE_REQUEST_HANDLER</tt> (chosen at random). </p>
<h3 style="margin: 10px 0 0 0; font-size: 16px; line-height: 1.563; margin: 30px 0 0 0"><a name="Tonote" style="color: #3b73af; text-decoration: none"></a>To note</h3>
<ul>
<li>
<a href="https://www.iis.net/learn/application-frameworks/building-and-running-aspnet-applications/aspnet-integration-with-iis" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">This link</a> has the best description of the pipeline stages I have found.
</li>
<li>
At BEGIN_REQUEST setting of server variables succeeds, but has no effect
</li>
<li>
At BEGIN_REQUEST, if a request header is set then the value has ': ' (semicolon, space) prepended
</li>
<li>
At PRE_EXECUTE_REQUEST_HANDLE setting the server variable REMOTE_USER succeeds but it causes later processing to fail with the following stack in the event log:
<div class="code panel" style="border-width: 1px;; border: 1px solid #ccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #ccc; -moz-border-radius: 3px 3px 3px 3px; border-radius: 3px 3px 3px 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-java" style="margin: 10px 0 0 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal">
This server variable cannot be modified during request execution. at <span class="code-object" style="color: #910091">System</span>.Web.HttpServerVarsCollection.SetServerVariableManagedOnly(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value) at <span class="code-object" style="color: #910091">System</span>.Web.HttpServerVarsCollection.SynchronizeServerVariable(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value, <span class="code-object" style="color: #910091">Boolean</span> ensurePopulated) at <span class="code-object" style="color: #910091">System</span>.Web.HttpRequest.SynchronizeServerVariable(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value) at <span class="code-object" style="color: #910091">System</span>.Web.Hosting.IIS7WorkerRequest.GetServerVarChanges(HttpContext ctx) at <span class="code-object" style="color: #910091">System</span>.Web.Hosting.IIS7WorkerRequest.SynchronizeVariables(HttpContext context) at <span class="code-object" style="color: #910091">System</span>.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
https:<span class="code-comment" style="color: #808080">//iis.steadingsoftware.net:443/mypictures/secure/time.tm
</span> /mypictures/secure/time.tm
10.0.0.100
False
IIS2012\Administrator
7
IIS2012\Administrator
False
at <span class="code-object" style="color: #910091">System</span>.Web.HttpServerVarsCollection.SetServerVariableManagedOnly(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value) at <span class="code-object" style="color: #910091">System</span>.Web.HttpServerVarsCollection.SynchronizeServerVariable(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value, <span class="code-object" style="color: #910091">Boolean</span> ensurePopulated) at <span class="code-object" style="color: #910091">System</span>.Web.HttpRequest.SynchronizeServerVariable(<span class="code-object" style="color: #910091">String</span> name, <span class="code-object" style="color: #910091">String</span> value) at <span class="code-object" style="color: #910091">System</span>.Web.Hosting.IIS7WorkerRequest.GetServerVarChanges(HttpContext ctx) at <span class="code-object" style="color: #910091">System</span>.Web.Hosting.IIS7WorkerRequest.SynchronizeVariables(HttpContext context) at <span class="code-object" style="color: #910091">System</span>.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
</pre>
</div>
</div>
<p style="margin: 10px 0 0 0">(gotta love the CLR subsystem).<br /> The first two are why I separated the handler from the filter. The second means that we end up with two spoof-check headers </p>
<ul>
<li>
<tt>ShibSpoofCheck</tt> value <tt>: 123456789</tt> (from BEGIN_REQUEST)
</li>
<li>
<tt>ShibSpoofCheck:</tt> (safeheader) value <tt>123456789</tt> (from PRE_EXECEUTE_REQUEST)<br /> The third is a PITA but not unexpected, and may yet prove be fixable.
</li>
</ul>
</li>
</ul>
<p style="margin: 10px 0 0 0">Bottom line: more research & nature study & so on is in order. </p>
<h3 style="margin: 10px 0 0 0; font-size: 16px; line-height: 1.563; margin: 30px 0 0 0"><a name="Actions" style="color: #3b73af; text-decoration: none"></a>Actions</h3>
<p style="margin: 10px 0 0 0">The following actions spring to mind:</p>
<ul>
<li>
Determine the distinction between returning <tt>RQ_NOTIFICATION_FINISH_REQUEST</tt> and calling <tt>IHttpContext::SetRequestHandled()</tt>. I’m hoping that the first stops processing at this particular stage of the pipeline and the second end all processing.
</li>
<li>
I need to deep dive into SafeHeaders in the ISAPI filter and why mod_shib doesn’t have them
</li>
<li>
I need to work out whether there are stages that get over the restrictions above.
</li>
<li>
Discover whether the AbstractSPRequest methods <tt>doAuthentication()</tt>, <tt>doExports()</tt>, and <tt>doAuthorization()</tt> can be separated the same way that <tt>doHandler()</tt> can be
</li>
<li>
I think that this might end up in a deep dive in IIS AuthN and potentially AuthZ. It might be that the ‘correct’ way to set REMOTE_USER will be to do AuthN and to set an Windows Principal at the same time (make it a different one, that might be a nice hint to the user that AuthN happened), dunno. This leads down the track marked GSS (another learning cliff I have been avoiding, but one which might end up with the cute ability to let Shib be the login to Windows domains).
</li>
<li>
At an appropriate time (not now, but soon) I should check into the real cpp-sp project . Right now this is all going into a personal repository (git.shibboleth.net:rdw/cpp-sp-iis). Guidance welcome as to when that time might be.
</li>
<li>
I need to move my DS onto IIS. Right now having 4 VMs running so I can test this (IIS/DS/IdP/AD) uses up a fair whack of memory on my dev box. So this is part making my life easier and part testing the integration.
</li>
<li>
Is there something better we can do to about the host name to get away from all that sites nonsense. I had an insight that if you rename a site (from “default site”) to something meaningful like iis.exmaple.org there would be a way of getting that name. That would be cool.
</li>
<li>
Full code review of what we have. The entire module is 550 lines right now, this will grow. An early review might be handy. Maybe after my vacation. I'll start to make notes in the code about what makes me nervous.
</li>
<li>
Configuration. Can we pull off the “bootstrap” trick and thus avoid having to put all the shibboleth dlls into {{ C:\Windows\System32\InetSRV }}
</li>
<li>
Configuration: How do we want to control useHeaders and useVariables. It is currently coded up to be per request, with the values being seeded from globals which are hard wired.
</li>
<li>
My install. I debug this remotely (my IIS is in a VM, my VS is in my desktop). This so easy. Any value in documenting this? If so where?
</li>
<li>
Installation, yup gotta have an installer. Do we want ISAPI (see below) as well as this (yes) if so how to control.
</li>
<li>
Testing plan
</li>
<li>
ISAPI.
<ul>
<li>
Do we want to do anything more about ISAPI installation (replace the VBScript by use of {{ C:\Windows\System32\InetSRV\appsrv.exe}}}
</li>
<li>
What is the “continue supporting it” story? V4 seems soon to remove support but V5 seems long.
</li>
<li>
AOCB
</li>
</ul>
</li>
</ul>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0px; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-694#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-6e1ac955-8bbb-4cd5-93ac-1f5a316ecaa2" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle" /> </a>
</td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-694#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #fff; border-top: 0; border-left: 1px solid #ccc; border-bottom: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly">
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">
This message was sent by Atlassian JIRA <span id="footer-build-information">(v7.0.10#70120-<span title="37e3d7a6fc4d580639533e7f7c232c925e554a6a" data-commit-id="37e3d7a6fc4d580639533e7f7c232c925e554a6a}">sha1:37e3d7a</span>)</span>
</td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-060d69dd-92a1-467c-b9d1-17f52ba3239e" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix" />
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>