*SOLVED* RE: Help with Shib/IIS

[Richard Vernick]

I'm not really sure why it didn't work but, here's the short answer. The return URL was critical:

I originally wanted to protect the root web site, but the shib documentation says not to leave the request mapper <path> specification empty or use "/". Since our application (MVC) uses ASP .Net forms authentication and .Net will automatically redirect the authentication to our login path, that's what I had shib protect. Using that, shib would intercept and redirect over to the IDP. When it came back, we could see the attribute in the session, but not in the header.

Our application hook to Shib has a specific path. When we changed the <path> from the Windows authentication path to our shib-specific path, the attributes appeared in the header and we're off to have a drink.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, July 16, 2015 2:26 PM
To: Shib Users
Subject: Re: Help with Shib/IIS 

On 7/16/15, 12:47 PM, "users on behalf of Richard Vernick" <users-bounces at shibboleth.net on behalf of rvernick at pyramed-health.com> wrote:

>Current state: Shibboleth is installed. Redirect to IDP is working. Upon return, we see the attribute in the shibboleth session, but it’s not making its way into the header. The only header attribute related to shibboleth we DO see is ‘ShibSpoof’ so something from Shibboleth is making its way into the headers.

If anything is there, either it's all there, or it's not a protected resource at all, but in that scenario it wouldn't redirect you to the IdP either. If you're putting a rule into the RequestMap and accessing the resource directly, getting redirected away, back, and landing on the original resource, then the headers are there. At minimum the standard ones would be, even if attribute issues from the IdP were involved.

So some aspect of that description is not true, or you're not in fact accessing the headers in a fashion that works. That is language-specific and subject to lots of foibles and bugs, as have been discussed on the list at times.

Enumerating headers, for example, is hopeless. Too many bugs in the various environments to do that reliably.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net