Bug in SP evaluation of nested Path statements?

[Michael W. Brogan]

I have a Shib SP configuration that isn't working as I expect it to. This is on v 2.4.3 running on Win2008R2/IIS7.5. Maybe my expectations are wrong, but it seems like a bug.

I'm attempting to protect content in specific directories with Path statements. This config works properly for all configured paths:

<Host name="diafine3.cac.washington.edu">
    <Path name="secure" authType="shibboleth" requireSession="true"/>
    <Path name="stepup" applicationId="stepup2f" authType="shibboleth" requireSessionWith="uwtoken"/>
    <Path name="test" authType="shibboleth">
        <Path name="secure" authType="shibboleth" requireSession="true"/>
        <Path name="stepup" applicationId="stepup2f" authType="shibboleth" requireSessionWith="uwtoken"/>
    </Path>
</Host>

If I comment out the first two path statements then the test/secure path still works as expected, but the test/stepup path doesn't. After hitting the authentication service and being returned to my SP I get the error:

"Shibboleth Error
ISAPI extension can only be invoked to process Shibboleth protocol requests. Make sure the mapped file extension doesn't match actual content."

I've got the default mapping to .sso and there is no actual content that matches.


Michael W. Brogan
Technical Lead, Identity and Access Management
UW Information Technology University of Washington
206-685-7521


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120106/65f4659c/attachment.html