Does Shib on IIS "see" every request even if no RequestMapper rule triggers it?

[Michael A Grady]

I'm used to Apache where you need to explicitly enable mod_shib to "see" a request by adding:

AuthType shibboleth
Require shibboleth

for any path that you want Shib to potentially do something. Does IIS differ on that? Assuming you have correct mappings in the ISAPI section, is Shib "lurking" in the background for every request? So that passive authentication can happen successfully without any RequestMapper config covering a path? (That if one directs the user to the SessionInitiator to trigger authentication, the received info back from the IdP will be available as HTTP Headers to any service on that IIS server, even if a RequestMapper rule doesn't apply to its path?

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.