IIS SP error with BlackBaud BBIS

[Liam Hoekenga]

Last year, we deployed BlackBaud's Internet System ("BBIS") for our
development (fundraising) office.  They now want to upgrade it to
v3.0, and we're seeing problems.
We're using IIS 7.5 on Windows Server 2008r2.  If you hit the login
endpoint (either directly, or through the app's login process), we get
this error message...

    xmltooling::IOException at
(https://bbistest.example.edu/Shibboleth.sso/SAML2/POST)
    Error reading request body from browser (2746).

The application is interfering with shibboleth in some fashion.  It
wants to intercept every request to any location on that virtual host.
 Their original customization ignored "/Shibboleth.sso/SAML2/POST",
allowing the ISAPI module to handle it.  They have since opened up all
of "/Shibboleth.sso/", so any of those requests /should/ flow through
to the ISAPI module.

The same shib installation works with an earlier revision.

The IdP shows that attributes are being released correctly.

shibd.log looks ok..
2013-08-20 14:31:43 DEBUG Shibboleth.Listener [2]: dispatching message
(bbistest.example.edu/Login::run::SAML2SI)
2013-08-20 14:31:43 DEBUG XMLTooling.StorageService [2]: inserted
record (5269905f4916f16df15abb41e926eb01) in context (RelayState) with
expiration (1377024103)
2013-08-20 14:31:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]:
validating input
2013-08-20 14:31:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]:
marshalling, deflating, base64-encoding the message
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: starting to
marshal samlp:AuthnRequest
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: creating root
element to marshall
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling
namespace attributes for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling text
and child elements for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: starting to
marshalling saml:Issuer
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: creating root
element to marshall
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling
namespace attributes for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling text
and child elements for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: caching DOM for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: starting to
marshalling samlp:NameIDPolicy
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: creating root
element to marshall
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling
namespace attributes for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: marshalling text
and child elements for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: caching DOM for XMLObject
2013-08-20 14:31:43 DEBUG XMLTooling.XMLObject [2]: caching DOM for
XMLObject (document is bound)
2013-08-20 14:31:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]:
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://bbistest.example.edu/Shibboleth.sso/SAML2/POST"
Destination="https://idp-qa.example.edu/idp/profile/SAML2/Redirect/SSO"
ID="_b6df12e5c3a4cf1780faeef829bbf16f"
IssueInstant="2013-08-20T18:31:43Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://bbistest.example.edu/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2013-08-20 14:31:43 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]:
message encoded, sending redirect to client

and it's immediately followed by this entry in native.log...
2013-08-20 14:31:54 ERROR Shibboleth.ISAPI [6772]
isapi_shib_extension: Error reading request body from browser (2746).

I found a response from Scott in May 2011
(https://lists.internet2.edu/sympa/arc/shibboleth-users/2009-09/msg00510.html)
suggesting that 2746 is an internal windows error.

I'm hoping someone has some suggestions on how to further debug this.
It would be excellent if we could go back to the vendor with more
information, because I'm pretty sure that this is something they have
to fix.

thanks
Liam