trouble with iis 7.5 windows sever 2008 r2

[Roger Reynolds]

Scott - your comments regarding running in 32 and 64 bit mode don't match what I am seeing. Maybe I need to explain my environment more clearly...

I have a 64 bit OS and in IIS, a number of applications, all with their own app pool, some of which have 32bit enabled, and host .NET assemblies that are built for x86 rather than "Any CPU".

My first attempts were to install the 64 bit version of shibboleth, first time, with the 32 bit unchecked. 
When I did that trying to access any page on my server would blow up with this error:

ISAPI Filter 'C:\opt\shibboleth-sp\lib64\shibboleth\isapi_shib.dll' could not be loaded due to a configuration problem. The current configuration only supports loading images built for a x86 processor architecture. 

So then I'd uninstall shibboleth and reinstall, this time with the 32bit box checked.
Then, the site would blow up and say this:

ISAPI Filter 'C:\opt\shibboleth-sp\lib\shibboleth\isapi_shib.dll' could not be loaded due to a configuration problem. The current configuration only supports loading images built for a AMD64 processor architecture. 

This drove me crazy for a few hours.

Then I uninstalled shibboleth, reinstalled choosing not to install the ISAPI filters.
Then I went in and manually added both the 32 and 64 bit versions of the filter and handler mappings, and noted that when I did this the preCondition attrs that I mentioned were created.
And with that, it works perfectly.

fwiw, when I had just the 64 bit filter installed, with the preCondition attr, the site would load ok, but the shibboleth filter was activated for my 32 bit apps. Conversely, if I installed just the 32 bit version with the preCondition attr, the site would load but shibboleth would not process my 64 bit apps.

So I guess my suggestions would be, at least for IIS, for the installer to remove that 32bit checkbox and install both architecture ISAPI filters with the preCondition attrs set.

Thanks again.


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Sunday, June 02, 2013 11:39 AM
To: Shib Users
Subject: Re: trouble with iis 7.5 windows sever 2008 r2

On 6/2/13 12:44 PM, "Roger Reynolds" <rreynolds at axiomepm.com> wrote:
>Specifically HTTP_EPPN.  Those are decrypted from the _shibsession_ 
>cookie, right, so they should be pretty tamper proof, I'm assuming.

They are on the server in the session cache, not in the cookie. The headers set are protected against spoofing through various means that you can read about in the wiki.

>I have some extra complication here because some of the asp.net apps I 
>need to secure require 32 bit (cuz they use an unmanaged oracle data
>provider) so in the end I needed to manually install and configure both 
>the 32 and 64 bit shibboleth filters and handlers, and what is 
>important is that we end up with entries like so in the app config:

The SP doesn't support running in both modes at the same time. It installs both sets of files, but you have to pick one at a time.

>Note the preCondition  attrs. I believe those are critical and seem not 
>to be created by the shibboleth installer.

It doesn't matter. The arch is locked to whatever the shibd service is running with.

>How does one logout?

In practice you don't. Logout in a federated SSO environment is essentially undeployable and will become more so as third party cookies become less accepted. The wiki discusses this at length, and the Shibboleth IdP does not support SAML logout.

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues

>I could delete the _shibsession_* cookie and redirect to my home page I 
>guess.
>Is there a standard way to do that?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogoutInitiato
r


Yes, /Shibboleth.sso/Logout?return=

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net