Shibboleth SP "bitness" and IIS virtual applications

[Stojkovic, Marko]

Hello,

I have some questions about Shib SP installation/setup in Windows / IIS 7.5.  I know that the SP now comes in two different flavors (32bit and 64bit) and that you must match it with your IIS site's "bitness."  However, I'm not sure how to apply that in the following scenario.  Say you have a web server with the following IIS site hierarchy:

- IIS SERVER ROOT
---- IIS Site 1 (using 64bit app pool)
-------- IIS Virtual Application ABC (using 64bit app pool)
-------- IIS Virtual Application XYZ (using 32bit app pool)
---- IIS Site 2
---- IIS Site 3

By "virtual application" I mean a special IIS "sub-site" that functions in the same root URL, but loads in a separate app pool and acts pretty much as an independent site.

Let's say "Virtual Application XYZ" is the only one you want protected by and using Shib.  So the question is:  How do you properly setup Shib bitness and ISAPI filters?  



More background info:

I'm asking this because we ran into an issue today, after we upgraded to 2.5.2 from several versions back (so it was an uninstall and a fresh install, as per Shib instructions).  I ran 64bit installer and chose 32bit mode during the installation process, knowing that my "application XYZ" is using a 32bit app pool.  I also chose YES for letting the package configure IIS.  It placed ISAPI Filter settings and Handler Mappings at the IIS SERVER ROOT.  I thought this would be fine.  And indeed, the "virtual application XYZ" ran fine.

However, it caused Shib DLL loading error in the virtual app "ABC", which is another IIS virtual application under the same parent site.  I quickly realized this was because it was inheriting Shib ISAPI settings from the parent site (which was inheriting it from the IIS SERVER ROOT), and it was trying to load Shib 32bit DLLs, which explained the error.  Since the app "ABC" doesn't need Shib, I thought I would just isolate the Shib configuration to app XYZ.

However, ISAPI Filter settings can only be configured at a SITE level--not at the virtual application level.  For a moment it seemed like I could either get my 32bit "XYZ" app to work (with Shib), or get the ABC 64bit site to work without Shib on XYZ.  Not both.

In troubleshooting this further, I removed the ISAPI Filter and Handler Mapping configuration from the IIS ROOT, and added it manually to "IIS Site 1" (remember, I cannot add this at the virtual application level).  I thought this would continue to cause the same problem for 64bit app ABC, but to my surprise, both ABC and XYZ work fine.   How is that the case?  

Before my change, the IIS Site 1 would have presumably inherited the Shib ISAPI and Mappings settings from IIS ROOT.  This way, it had the same settings, but placed "locally."  Wouldn't the end result be the same for sub-apps ABC and XYZ?

Thanks!

Marko Stojkovic
Application Development Coordinator
Committee on Institutional Cooperation
217-265-4111
mstojkov at staff.cic.net
*********************************************************************
The CIC is the nation's premier higher education consortium of top-tier research institutions, including the Big Ten Conference members and the University of Chicago. Through collaboration CIC members save money, share assets, and increase teaching, learning and research opportunities.