Shibboleth SP - Errors on IIS/Win 2003

[Cantor, Scott]

On 10/22/14, 8:03 AM, "Pete Williams" <pxc433 at hotmail.com> wrote:

>The errors are as follows. When you navigate to:
>
>http://mysite.com/secure.sso
>
>then this is displayed in the browser

You shouldn't be using any URLs that end in *.sso except for the handlers,
which should start with /Shibboleth.sso. I strongly advise not changing
that, if that's what you're trying to do.

If you do need to use that extension for other things of your own, then
you *should* actually change handlerURL to something else and map the
extension using a different suffix from .sso

>The native.log file says:
>
>2014-10-22 11:29:45 ERROR Shibboleth.StatusHandler : invalid CIDR block
>(::1): Unable to parse address in CIDR block

That's pretty surprising, that would seem to suggest your system doesn't
support IPv6 even at a library level, but it has nothing much to do with
anything. If it's breaking altogether because of that, take it out.

>My entry for isapi mapping is:
>
><ISAPI safeHeaderNames="true" normalizeRequest="true">
><Site port="8080" scheme="http" name="mysite.com" id="1233"/>

I have no way to determine if that's correct, but it certainly doesn't fit
the URL you posted. That would imply that the public URLs used are http
and on port 8080. Those are logical values, not physical ones, as the
documentation says.

>This iis server is behind a reverse proxy. The proxy uses SSL, but all
>traffic on the 'inside' of the proxy is http. The IIS server uses 8080.

Then scheme is https and the port is 443.

>The name, mysite.com, is taken from the IIS management applet - it is the
>column displayed under 'host header value'. The ID is from the Identifier
>column from the same app.

The name is what you expect clients to use when they access the proxy. It
can only come from that knowledge, not from any console or configuration
file.

-- Scott