trouble with iis 7.5 windows sever 2008 r2

[Roger Reynolds]

Scott - 
Thanks again for your initial response.  I believe I have worked out how to do the authorization bits, by using values found in the server variables of the submitted request. 
Specifically HTTP_EPPN.  Those are decrypted from the _shibsession_ cookie, right, so they should be pretty tamper proof, I'm assuming.

I have some extra complication here because some of the asp.net apps I need to secure require 32 bit (cuz they use an unmanaged oracle data provider) so in the end I needed to manually install and configure both the 32 and 64 bit shibboleth filters and handlers, and what is important is that we end up with entries like so in the app config:

    <filter name="Shibboleth64" path="C:\opt\shibboleth-sp\lib64\shibboleth\isapi_shib.dll" enabled="true" preCondition="bitness64" />
    <filter name="Shibboleth32" path="C:\opt\shibboleth-sp\lib\shibboleth\isapi_shib.dll" enabled="true" preCondition="bitness32" />

Note the preCondition  attrs. I believe those are critical and seem not to be created by the shibboleth installer.

So I think I'm pretty good here, though I guess I do have one next question..

How does one logout?
I could delete the _shibsession_* cookie and redirect to my home page I guess.
Is there a standard way to do that?

Thanks again.


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Roger Reynolds
Sent: Saturday, June 01, 2013 4:40 PM
To: Shib Users
Subject: RE: trouble with iis 7.5 windows sever 2008 r2

Thanks for the quick response.
Couple things...

- I couldn't agree more with your comments on the w2k12 ui.  I'm not a fan of windows 8 either, but they've taken it to a whole new level on the server OS.
I thought I read someplace that ISAPI filters were no longer supported in IIS8, I guess it is more like they are no longer considered the best way.  So it's good to know that it does work.

- You were be correct about my dev machine environment and testshib.  I went ahead and uploaded the metadata to and, to my surprise, it worked.  That is, it redirected my attempt to access my "secure" pages to the test IdP, and then back to my test page after auth.  So, that's good.     The thing is, the only header I see after authenticating is the cookie _shibsession_<longrandomlookingstring>.  I was expecting to see some other items that would help me discover the username that was used to authenticate with.  

- As far as that other server goes...  I edited the shibboleth2.xml config file again, restarted the services again, and then I was getting a different error. Discovered that the URLs at and below Shibboleth.sso are case sensitive. Grrr.  I get a variety of errors unless I use exactly  Shibboleth.sso/Metadata. If I do that, it works and I can get my metadata and I can upload it to testshib and authenticate and all is well.  I don't know about the rest of the world, but my expectation is that URIs are not case sensitive. My wanna call that out someplace.     (Hmm, still got an issue with HTTPS vs HTTP, but not focused on that at the moment.)

- Anyway, now I'm pretty much to the same place with both servers, which can be stated as - now that we're authenticated, how do we do authorization?  I'm sure that's described out there somewhere...

Thanks again for your help and the quick response. 
Any pointers or samples of asp.net + shibboleth + authorization would be much appreciated.

roger


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Saturday, June 01, 2013 2:52 PM
To: Shib Users
Subject: Re: trouble with iis 7.5 windows sever 2008 r2

On 6/1/13 3:16 PM, "Roger Reynolds" <rreynolds at axiomepm.com> wrote:
>Problem is, that machine is not publicly visible, so I think it doesn¹t 
>do me much good as far as trying to register that metadata with the 
>test IP.

I don't think testshib cares unless you're using flows involving SOAP.

>I am sure that the isapi filter is up and running and processing requests.
>I cranked up the native.logging to debug, and I see this for an 
>incoming
>request:
>2013-06-01 11:11:58 DEBUG Shibboleth.ISAPI [3968] isapi_shib: mapped 
>http://shibtest.mycompany.com/Shibboleth.sso/Metadata to default

Those spaces in your log enities there seem suspicious to me. I would check for whitespace in your XML file that might be throwing something off. I would have to check the code to see whether it's handling that or not.

I can't really identify an obvious issue, something is off in your Site mappings.

That error usually involves SSL offloading or load balancing. If you have some kind of bizarre network situation, the way a lot of firewall-obsessed places do, that might be a source of complexity.

>Also, note that if I stop the shibd service, it makes no difference.  
>By that I conclude that the ISAPI filter is not recognizing the request 
>as being something that it wants to handle.

Extension, actually, not the filter, but yes.

>Also, an unrelated question -   is Shibboleth supported, or can it be
>manually configured, for Windows Server 2012 and IIS 8?  It doesn¹t 
>appear to be listed as such, and there are no ISAPI Filters in IIS8, so 
>my assumption is that it is not possible.  Is that correct?

I just did the first actual test of the software on it, that's why it's not listed. IIS 8 certainly supports filters (seeing as I just tested it).

(That aside, the UI for Server 2012 is the most hysterically awful joke I think I've ever seen.)

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net