Uploads over SSL failing after SAML integration

[MikeWho]

Point taken. :) Sorry, I'm never sure which changes in the Shibboleth xml
file require restarts to the Shibboleth daemon, or the IIS site, or IIS
itself.. The answer is - it's possible to 'secure' a folder then 'unsecure'
a file within it, which is great. 

Unfortunately, it just reveals an awkward problem - our .Net session string
is included in the URL of all calls to our .Net app (including the upload
script). Since that session is dynamic, we can't cater for it in the
RequestMapper - unless it has some wildcard facility I haven't noticed in
the documentation. 

i.e. the URL format is: https://www.example.com/AppPath/[.Net session
key]/UploadFile.aspx

So we can either set requireSession to true or false for the entire AppPath
folder, but we can't specify requireSession=true for
..../Authentication.aspx (for secure login) and requireSession=false for
.../UploadFile.aspx (so we can upload files). 

If there's no wildcard that we can use, I guess we'll have to separate the
upload and authentication pages into different locations so we can set
requireSession separately for both.

Thanks again for the advice. 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Uploads-over-SSL-failing-after-SAML-integration-tp7583430p7583460.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.