Proxy and ISAPI extension not configured error

[Cantor, Scott]

On 9/12/12 9:20 PM, "Istvan Gonzales" <istvangonzales at gmail.com> wrote:

>I looked closer into my problem with SP not accepting an authn assertion
>through the proxy. I decrypted the "good" assertion and the "bad"
>assertion and I see no differences of substance in their content. Each
>has an AttributeStatement and an AuthnStatement,
> and only a session ID differs between the two AuthnStatements.

If you're still talking about the same error, the issue has absolutely
nothing to do with SAML or your assertions. The web server(s) are simply
not configured correctly and are not processing requests consistently with
the URLs you intend them to be seeing. The external and internal views
don't line up and that's not allowed.

That's not at all unusual when a load balancer is involved, and it would
be difficult or impossible to allow the SP to work for requests both
through and around the load balancer because the web server can't know
that that's happening. It has to handle requests based on the virtualized
settings in use with the load balancer and that won't work for direct
client access.

> 
>I also learned a tad bit more about the environment. This is an F5 proxy.
>No DNS is setup yet. But this shouldn't matter as long as there is a host
>entry on the test machine and if the default configuration uses front
>channel binding. Does the SP contact
> the IdP directly?

That depends on the profiles used, but it has nothing to do with the error
in the subject.

If you want to see how it's processing requests, turn up native.logger and
see what the RequestMap is seeing. It will be off in some way in the cases
that don't work.

-- Scott