Shibboleth SP and IIS authentication

[Cantor, Scott]

> I have a doubt and i don't find a lot information googling. My problem is
> the follow, i have an application that run in IIS. This has delegated the
> authentication in IIS, and now the authentication type is "Windows
> Authentication". Well, now i wan't to use Shibboleth authentication. I have
> deployed Shibboleth SP and my IDP, and i now that the SAML authentication
> is done (i have the shibboleth sessión cookie). Well my question is, what kind
> of authentication type i must to select to create a IIS session? (Windows
> authentication, annonymous,..) or maybe isn't possible, and i must to modify
> the application to extract the session information of the Shibboleth SP?

The latter. There is no integration with any options within the IIS tools that involve Shibboleth other than getting the filter, extension, and script mappings in place (if the installer fails to do so adequately). None of the built-in "types" of authentication involve the SP.

So you're not missing anything, and IIS' limitations mean that the most appropriate basic integration strategy of using REMOTE_USER unfortunately doesn't work. Whether using the newer IIS 7 APIs will fix that or not I don't know, but it definitely won't ever work on anything older.

If you need SAML support and that kind of integration, ADFS is a better fit.

-- Scott