Configuring IIS for 1 SP, multiple domains

[Anna Maurer]

Hi Scott,

Responses inline.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Cantor, Scott
Sent: Wednesday, August 24, 2011 14:05
To: users at shibboleth.net
Subject: Re: Configuring IIS for 1 SP, multiple domains

On 8/24/11 4:41 PM, "Anna Maurer" <annam at berkeley.edu> wrote:

>I¹m looking for resources on troubleshooting a Shibboleth SP with IIS, 
>Load Balancer, and two different domains pointing to the same set of 
>files.

Simpler approach, don't use separate IIS sites, and just create aliases in
DNS. Add an <Alias> to the <Site> element so the SP will accept the second
name for the system when it generates URLs and you're done.

--Thanks - I'll give that a try! Unfortunately, we cannot change the current
setup with separate IIS sites. --


> 
>Results:
>                https://basicsite.example.com/secure - success. Loads 
>the Test IdP page.
>                https://site.othersite.com/secure  - failure. 
>Immediately gets a 404 error, file not found. Stopped at the IIS level.

Somebody here reported something similar without indicating how it got
fixed, if it did, and I continue to maintain that's not possibly an SP
issue. The SP can't return the 404, that's IIS. I have no explanation for
how that can happen on a request to a resource. I asked for and did not get
any detailed native.log output for what the request looked like when the SP
mapped it.

--I was almost positive it wasn't an SP issue directly, but more an IIS/SP
configuration issue. These two domains have co-existed in this fashion for
over two years. It's only with the SP that they are behaving differently. I
think there's a configuration setting somewhere in the IIS or Load Balancer
config files relating to this issue, but have no idea what. --

> 
>I have loaded each site using ³shibboleth.sso², and they give the same 
>ISAPI error.

No idea what that means (and "shibboleth.sso" will never work).

-- I loaded https://basicsite.example.com/shibboleth.sso and
https://site.othersite.com/shibboleth.sso and got " ISAPI extension can only
be invoked to process Shibboleth protocol requests. Make sure the mapped
file extension doesn't match actual content.".  I knew this wouldn't do
anything, but I was curious and running out of ideas on things to check. I
was collecting data for more research.--

> I loaded another Domain that also points to 
>\\<servername>.example.com\myproject ­ 
>https://othersite.example.com/Shibboleth.sso - and got a message saying 
>it wasn¹t configured for Shibboleth, which I expected.

I don't know what that means either (in the sense that I don't know what the
error message you're talking about is).

--I loaded https://othersite.example.com/Shibboleth.sso/ and got "Shibboleth
Extension not configured for web site (check ISAPI mappings in SP
configuration)." I expected to see something like this, as this Site ID is
not in shib2.xml. --

> 
> 
>The final wrinkle is that another department is responsible for the 
>physical server, and installing the SP software, but I¹m responsible 
>for configuring it. I do not have access to check internal IIS or Load 
>Balancer configuration files, I can only request ³please verify that 
>the LB config file includes XXX².

You can't do the SP separately from IIS. They're a unit. The SP is not an
application, it's part of the web server.  Almost certainly you cannot fix
this without access to IIS because it's IIS itself that's misconfigured.
Could be a script mapping problem, a filter problem, whatever, but the
integration touchpoints are broken and you can't fix that in shibboleth2.xml

--And that's the core of my problem - IIS is misconfigured somehow and it's
up to me to tell the server people where it's misconfigured for SP for
non-example.com domains, and how to reconfigure it. I'll check out the terms
you mention above, see if something crops up.

Thanks for the tips,

Anna

 --


-- Scott

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net