Configuring IIS for 1 SP, multiple domains

[Cantor, Scott]

On 8/24/11 4:41 PM, "Anna Maurer" <annam at berkeley.edu> wrote:

>I¹m looking for resources on troubleshooting a Shibboleth SP with IIS,
>Load Balancer, and two different domains pointing to the same set of
>files.

Simpler approach, don't use separate IIS sites, and just create aliases in
DNS. Add an <Alias> to the <Site> element so the SP will accept the second
name for the system when it generates URLs and you're done.

> 
>Results:
>                https://basicsite.example.com/secure - success. Loads the
>Test IdP page.
>                https://site.othersite.com/secure  - failure. Immediately
>gets a 404 error, file not found. Stopped at the IIS level.

Somebody here reported something similar without indicating how it got
fixed, if it did, and I continue to maintain that's not possibly an SP
issue. The SP can't return the 404, that's IIS. I have no explanation for
how that can happen on a request to a resource. I asked for and did not
get any detailed native.log output for what the request looked like when
the SP mapped it.

> 
>I have loaded each site using ³shibboleth.sso², and they give the same
>ISAPI error.

No idea what that means (and "shibboleth.sso" will never work).

> I loaded another Domain that also points to
>\\<servername>.example.com\myproject ­
>https://othersite.example.com/Shibboleth.sso - and got a message saying
>it wasn¹t configured for Shibboleth, which I expected.

I don't know what that means either (in the sense that I don't know what
the error message you're talking about is).

> 
> 
>The final wrinkle is that another department is responsible for the
>physical server, and installing the SP software, but I¹m responsible for
>configuring it. I do not have access to check internal IIS or Load
>Balancer configuration files, I can only request ³please verify that the
>LB config file includes XXX².

You can't do the SP separately from IIS. They're a unit. The SP is not an
application, it's part of the web server.  Almost certainly you cannot fix
this without access to IIS because it's IIS itself that's misconfigured.
Could be a script mapping problem, a filter problem, whatever, but the
integration touchpoints are broken and you can't fix that in
shibboleth2.xml

-- Scott