IIS7 SP Doesn't activate on protected Path

[Don Faulkner]

Trying to Shibbolize a single site on an IIS7 host. Details below. The problem is:

If I go to https://default-site/secure, then I get sent to my IdP for authentication
If I go to https://site-to-protect/secure, then I fall straight through to my default.aspx file with no bounce to IdP and no shib variables.

I’ve tried other sites beside the site I’m interested in with the same results. I’ve configured IIS7 per the instructions in the wiki. To be sure, I bootstrapped a clean VM and tried again. To my dismay, this second VM works fine! So, I’m left wondering what odd thing in IIS is preventing the site from working.

What am I missing?

-----
Versions

IIS7, with many many sites. I’m protecting siteid=26, “myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>” [1]
Shibboleth SP 2.5.3
dual-stack IPv4 and IPv6. Names registered in IPv4 DNS only


-----
shibboleth2.xml (relavent bits)

<InProcess logger=“native.logger”>
  <ISAPI normalizeRequest=“true” safeHeaderNames=“true”>
    <Site id=“1” name=“www1-clone.uark.edu<http://www1-clone.uark.edu>”/>
    <Site id=“26” name=“myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>”/>
  </ISAPI>
</InProcess>

<RequestMapper type=“Native”>
  <RequestMap>
  <Host name=“www1-clone.uark.edu<http://www1-clone.uark.edu>”>
    <Path name=“secure” authType=“shibboleth” requireSession=“true”/>
  </Host>
  <Host name=“myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>”>
    <Path name=“secure” authType=“shibboleth” requireSession=“true”/>
  </Host>
  </RequestMap>
</RequestMapper>

<ApplicationDefaults entityID=“https://www1-clone.uark.edu/shibboleth” REMOTE_USER=“uid eppn persistent-id targeted-id”>
  <SSO entityID=“https://idp.uark.edu/idp/shibboleth”>
    SAML2
  </SSO>
  <MetadataProvider type=“XML” uri=“https://federation.uark.edu/metadata/uark-identity-metadata.xml”
    backingFilePath=“uark-identity-metadata.xml” reloadInterval=“7200”>
  </MetadataProvider>
</ApplicationDefaults>




[1] Please don’t flame me for poor DNS choices. It’s out of my control.
--
[http://goo.gl/2ZYiQ]   Don Faulkner, CISSP | CISO<http://security.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf at uark.edu<mailto:donf at uark.edu> | +1 (479) 575-5349
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140825/e7ba5d91/attachment.html