Shibboleth SP "bitness" and IIS virtual applications

[Stojkovic, Marko]

Scott,  I think you may have misunderstood (or I have).  I don't want to mix 32bit Shib with 64bit Shib.  I'm only mixing things in terms of IIS sites and apps.  I'm only using 32bit Shib SP to protect the 32bit apps.  However, I'm trying to understand how to configure things properly in a situation like I outlined (where I'm not directly protecting the whole IIS site but ONLY a particular IIS virtual sub-application).

If you will, please take a look at the "background info" section in my previous email.

Thanks, 

Marko


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, August 05, 2013 5:02 PM
To: Shib Users
Subject: Re: Shibboleth SP "bitness" and IIS virtual applications

On 8/5/13 5:51 PM, "Stojkovic, Marko" <mstojkov at staff.cic.net> wrote:
>
>I have some questions about Shib SP installation/setup in Windows / IIS 
>7.5.  I know that the SP now comes in two different flavors (32bit and
>64bit) and that you must match it with your IIS site's "bitness."
>However, I'm not sure how to apply that in the following scenario.  Say 
>you have a web server with the following IIS site hierarchy:
>
>- IIS SERVER ROOT
>---- IIS Site 1 (using 64bit app pool)
>-------- IIS Virtual Application ABC (using 64bit app pool)
>-------- IIS Virtual Application XYZ (using 32bit app pool)

With the basic install/assumptions you can't do that.

>Let's say "Virtual Application XYZ" is the only one you want protected 
>by and using Shib.  So the question is:  How do you properly setup Shib 
>bitness and ISAPI filters?

You pick the one size you need to run and don't mix them. That has been true for the life of the software.

There was a previous poster who claims to have come up with a way to mix them and make it work in at least some cases, by using a single shibd and he apparently determined that either filter would work at the same time, if some special IIS settings are used to control the loading of the filter. I have no familiarity with that approach, but I concluded that my assumptions about mixing archs talking to one shibd were probably overly paranoid on my part.

The email in the archive is under the subject line "trouble with iis 7.5 windows sever 2008 r2"

I would not be at all shocked if his trick was limited to working only with different app pool sizes on *different* sites. I can't think how it would work with one site, and again, that has never been supported or intended.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net