Error: ISAPI extension can only be invoked to process Shibboleth protocol requests

Fri Jun 20 12:24:58 EDT 2014

Hi,

I would like to know if anyone can help with this error wiht the POST handler
Whenever I go to:
https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST
https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST
https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST

I get:

"Shibboleth Error
ISAPI extension can only be invoked to process Shibboleth protocol requests.
Make sure the mapped file extension doesn't match actual content."

I noticed it's a common error and found some threads which I perhaps need to check:

Check if you have configured the following in the shibboleth2.xml
1. Site Id with correct id and name (IP address) OK
2. Handler with correct IP address and context - NOt sure what this means the HandlerURL?

I am Using IIS7 on a Windows Server 2008 (server computer name medweb.ad.med.miami.edu).

This my partial Shibboleth2.xml (I want to protect 3 different sites hosted in the same server medweb.ad.med.miami.edu)

   <InProcess logger="native.logger">
        <ISAPI normalizeRequest="true" safeHeaderNames="true">

            <Site id="1" name="medweb.ad.med.miami.edu" scheme="https" port="443" />
            <Site id="208" name="restrict1.uresearch.miami.edu" scheme="https" port="443" />
            <Site id="209" name="restrict2.uresearch.miami.edu" scheme="https" port="443" />
            <Site id="210" name="restrict3.uresearch.miami.edu" scheme="https" port="443" />

                </ISAPI>

                <RequestMapper type="Native">
        <RequestMap>
            <Host name="medweb.ad.med.miami.edu">
                <Path name="secure" authType="shibboleth" requireSession="true"/>
            </Host>
            <Host name="restrict1.uresearch.miami.edu" authType="shibboleth" requireSession="true"/>
            <Host name="restrict2.uresearch.miami.edu" authType="shibboleth" requireSession="true"/>
            <Host name="restrict3.uresearch.miami.edu" authType="shibboleth" requireSession="true"/>

And this is all I have. I don't have ApplicationOverride to override any ApplicationID's or
anything like that.
I just added to my metadata all redirects:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_bdab8d7cef943726ec06ad1efa72ae451ca98b7e" entityID="https://restrict1.uresearch.miami.edu">

<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
    <md:Extensions>
      <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://medweb.ad.med.miami.edu/Shibboleth.sso/Login"/>
    </md:Extensions>

   <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://restrict1.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="1"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="3"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="4"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="5"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="6"/>

                <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="10"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="10"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="20"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="30"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="40"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="50"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="60"/>

                <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="100"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="100"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="200"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="300"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="400"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="500"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="600"/>

Not sure why I am getting that error when I have my IIS ISAPI filters set up.
It is last in the list of ISAPI filters in IIS, I made sure it maps to:

Name               Executable
Shibboleth         C:\opt\shibobleth-sp\lib64\shiboleth\isapi_shib.dll

I also checked the Shib IdP logs, the native log in the SP and didn't find any errors.
Perhaps I need to open up more DEBUG?
I still don't understand what is the issue.
I noticed someone talked about the part of the session tags, which I don't have the handleURL.
My Session tag looks like:

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="http">

I thought it would default to /Shibboleth.sso anyways.
I'd appreciate anyone pointing me in the right direction.

Thanks!

Dyana Alvarez
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140620/f5d7e206/attachment-0001.html 