Does Shib on IIS "see" every request even if no RequestMapper rule triggers it?

[Cantor, Scott]

On 3/21/13 8:13 PM, "Michael A Grady" <mgrady at unicon.net> wrote:

>I'm used to Apache where you need to explicitly enable mod_shib to "see"
>a request by adding:
>
>AuthType shibboleth
>Require shibboleth

All auth modules are hooked on any request with an AuthType and a require
rule. They have to decide whether to do anything based on the AuthType,
but they all run on all types.

>for any path that you want Shib to potentially do something. Does IIS
>differ on that? 
>Assuming you have correct mappings in the ISAPI section, is Shib
>"lurking" in the background for every request?

Yes, unless the site is deliberately unmapped or the filter is selectively
installed on specific sites and not the root filter set. The code will run
at least far enough to map the request and then determine the settings
applied. That's the equivalent of Apache evaluating all the Location,
Directory, File, and htaccess settings, which happens on every request.
IIS has no such capability, so I have to do it. That's all the RequestMap
is.

> So that passive authentication can happen successfully without any
>RequestMapper config covering a path? (That if one directs the user to
>the SessionInitiator to trigger authentication, the received info back
>from the IdP will be available as HTTP Headers to any service on that IIS
>server, even if a RequestMapper rule doesn't apply to its path?

No. If authType isn't set for a request, the filter ignores the request
and there are no actions taken to clear any headers or perform any
functions. It is unsafe to look at any headers for requests to paths that
don't have authType set. They will be whatever the client wants them to be
and will never be the result of anything the SP does. Just as they would
be on Apache if you didn't set AuthType to shibboleth.

-- Scott