trouble with iis 7.5 windows sever 2008 r2

[Cantor, Scott]

On 6/2/13 12:44 PM, "Roger Reynolds" <rreynolds at axiomepm.com> wrote:
>Specifically HTTP_EPPN.  Those are decrypted from the _shibsession_
>cookie, right, so they should be pretty tamper proof, I'm assuming.

They are on the server in the session cache, not in the cookie. The
headers set are protected against spoofing through various means that you
can read about in the wiki.

>I have some extra complication here because some of the asp.net apps I
>need to secure require 32 bit (cuz they use an unmanaged oracle data
>provider) so in the end I needed to manually install and configure both
>the 32 and 64 bit shibboleth filters and handlers, and what is important
>is that we end up with entries like so in the app config:

The SP doesn't support running in both modes at the same time. It installs
both sets of files, but you have to pick one at a time.

>Note the preCondition  attrs. I believe those are critical and seem not
>to be created by the shibboleth installer.

It doesn't matter. The arch is locked to whatever the shibd service is
running with.

>How does one logout?

In practice you don't. Logout in a federated SSO environment is
essentially undeployable and will become more so as third party cookies
become less accepted. The wiki discusses this at length, and the
Shibboleth IdP does not support SAML logout.

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues

>I could delete the _shibsession_* cookie and redirect to my home page I
>guess.
>Is there a standard way to do that?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogoutInitiato
r


Yes, /Shibboleth.sso/Logout?return=

-- Scott