Does Shib on IIS "see" every request even if no RequestMapper rule triggers it?

[Michael A Grady]

On Mar 21, 2013, at 9:42 PM, Cantor, Scott wrote:

> On 3/21/13 10:14 PM, "Michael A Grady" <mgrady at unicon.net> wrote:
>> 
>> So to get the same behavior on IIS as the above two Apache config lines
>> provide on Apache (i.e. don't require a session to exist, but if it does,
>> add the information to the request environment), what is the
>> corresponding RequestMapper config? I don't see a NativeSPContentSettings
>> config that matches the basic "Require shibboleth" Apache config.
> 
> The "require" command's role in triggering authentication is an Apache
> limitation. On IIS, just set authType.
> 

Thanks.

I was trying to see if I could make any sense of a behavior I was seeing involving a IIS server and Shib SP 2.5.1. A single RequestMap rule has been configured like:

             <Host name="xxxx" port="443" scheme="https" >
                <Path name="fairly/long/path/name" authType="shibboleth" requireSession="true"/>
            </Host>

And the authType setting seems to be working, because if a user is sent thru the SessionInitiator endpoint and authenticates at their IdP, the service available on that path is getting the Shib-provided HTTP Headers added to requests. But if you go straight to the service, Shib isn't blocking you from getting there if you don't already have a Shib session established -- i.e. the requireSession="true" doesn't seem to be doing what I'd expect it to do --send the user thru the default SessionInitiator, and not let them "past" until there was a Shib session established.

Now it turns out that this behavior actually will be the desired behavior, and shouldn't have had the requireSession="true config element anyways. But I'm still puzzled how it was working before. I thought maybe the Path was somehow not matching, so that the Path RequestMap element wasn't getting "fired", but that can't be, because requests were still getting Shib-supplied Headers added if the user had been directed thru the SessionInitiator and already had a Shib session established.

Is there anything else I'm missing about IIS config, or something else I should be looking for?


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.