PathRegex Question

[Johnson, Jacob (GE, Intelligent Platforms)]

I'm trying to configure shibboleth SP on Microsoft IIS.  Everything is working great, except for one thing.

I want to exclude a single file in my application from being protected by SSO.  My ideas is to use <PathRegex> in shibboleth.xml to do this.  However, it does not work the way I expected it to.

This results in nothing being SSO protected:

<RequestMapper type="Native">
 <RequestMap applicationId="default">
  <Host name="mywebsite.com">
   <PathRegex regex=".*(?!open\.html)" authType="shibboleth" requireSession="true"/>
  </Host>
 </RequestMap>
</RequestMapper>

I thought my regex might be wrong so I tried this.  I expected it to protect everything, but it also results in nothing being SSO protected

<RequestMapper type="Native">
 <RequestMap applicationId="default">
  <Host name="mywebsite.com">
   <PathRegex regex=".*" authType="shibboleth" requireSession="true"/>
  </Host>
 </RequestMap>
</RequestMapper>

I confirmed that shibboleth is working by moving authType/requireSession to the <Host> tag.  This results in everything being SSO protected.

<RequestMapper type="Native">
 <RequestMap applicationId="default">
  <Host name="mywebsite.com" authType="shibboleth" requireSession="true">
  </Host>
 </RequestMap>
</RequestMapper>