SP v3 prerelease (windows)

[Doan, Tommy]

Sorry I omitted the detail but my testing is being done on a new Server 2016 OS and as the initial IIS and Shib SP installation, not as an upgrade. I had downloaded the SP installer on Friday morning but I see now it's since been updated so I'll use the latest and go through my testing again. More to come later this week. 

-----Original Message-----
From: dev <dev-bounces at shibboleth.net> On Behalf Of Rod Widdowson
Sent: Sunday, July 8, 2018 6:41 AM
To: 'Shib Dev' <dev at shibboleth.net>
Subject: RE: SP v3 prerelease (windows)

Thanks for this.  It's is immensely useful to get real deployment feedback.

> The 3.0.0.0 win64 installer still names the service "Shibboleth 2 Daemon (Default)".

Confirmed.  This is nasty - A new install works fine, but for historic reasons (which I cannot even remember) we do not touch the
SCM during upgrades.   I have opened SSPCPP-815 to track this.

> not immediately clear what the installation checkbox "Configure IIS7 
> modules" is for
>  - assumption is that without being checked, the module is installed 
> but not "enabled" for IIS

That's absolutely correct - you get the DLLs for all versions of all Web servers regardless of what webserver is actually installed

>  - appears to be for configuring the module to work with IIS

Yea, all it does is exactly this:

	appcmd install module /name:ShibNative32 /image:"c:\opt\shibboleth-sp\lib\shibboleth\iis7_shib.dll" /precondition:bitness32
	appcmd install module /name:ShibNative /image:"c:\opt\shibboleth-sp\lib64\shibboleth\iis7_shib.dll" /precondition:bitness64

>  - shouldn't this be enabled by default? that is the case for the 
> ISAPI modules with the v2 installer if the installer is run again 
> after an existing installation,

You shouldn't be seeing it on an upgrade.  It is just for initial installs.  There is (as always) history there.  In IIS6 days the IIS integration was distinctly fragile - hence the option to not doing and add it by hand later.  I just carried that forward.  I can completely see the motivation to do the configure if you have IIS installed (the whole dialog is supressed if it isn't there).
But there is also a case to be made to do zero configuration now that "configure" is two command lines.  After all we do nothing to configure Apache.

>  - the Change button does nothing
I've made a note in SSPCPP-817 to see if I can suppress it..

> the installer publisher (signing certificate) is unknown, which is 
> also the case with the v2 installer
>  - no functional problem, just the warning

I'm surprised it has an embedded code signature certificate at all actually.  The whole area (& history) of "code signing" certs for open source is fraught.  I'll observe that Apache's latest procrun executable (used to run Tomcat and the Shib IdP) is no longer code signed...

Thanks again for the feedback

Rod

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net