ISAPI extension can only be invoked to process Shibboleth protocol requests

[Fournier, Danny G]

I'm currently trying to debug a handlerUrl not serving up the status or metadata URLs. For instance: https://my.domain.com/esas.sso/status.

Note, I am aware of the difference in name and capitalization for handlerUrls. It's intentional and functional in our case (for instance, SiteID 1 & 2 mentioned later).

I'm getting the following error:

ISAPI extension can only be invoked to process Shibboleth protocol requests. Make sure the mapped file extension doesn't match actual content.

What I've done:
- I've made sure permissions were given to the application pool, IUSR and IIS_IUSRS on the folder in question.
- I've removed and reinstalled (many times) the ISAPI filter and Handler Mappings
- Changes would have me reboot shibd and iis (in that order)
- SiteID 1 and 2, not mentionned here, are functional and resolving handlerUrl attributes properly.

I've also been searching the mailing list archive for tips and, IMO, exhausted my options. Plus, a quick paste of these config blocks in Apache it works on the first try.

Relevant portions of shibboleth2.xml

<InProcess logger="native.logger">
                <ISAPI normalizeRequest="true" safeHeaderNames="true">
                                <Site id="8" name="my.domain.com" scheme="https" port="443" />
                </ISAPI>
</InProcess>
...
<Host name="my.domain.com" scheme="https" port="443">
                <Path name="abc" requireSession="false">
                                <PathRegex regex=".*" authType="shibboleth"
                                                requireSession="true" requireSessionWith="Internet" applicationId="xyz" />
                </Path>
</Host>
...
<ApplicationOverride id="xyz" entityID="my.id.here" homeURL="http://my.domain.com"
                REMOTE_USER="eppn persistent-id targeted-id" signing="true"
                encryption="false">
                <!-- cookieProps adding ;secure will only send cookie when it's over https.
                                Since we were on http, it didn't send it, creates a new session and returns
                                us on homeURL instead of where we're going -->
                <Sessions lifetime="7200" timeout="1020" checkAddress="false"
                                handlerURL="/esas.sso" handlerSSL="false"
                                cookieProps=";path=/;" exportLocation="http://localhost/esas.sso/getassertion"
                                exportACL="127.0.0.1" idpHistory="false" idpHistoryDays="7">
                                <md:AssertionConsumerService Location="/saml2/post"
                                                index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" />
                </Sessions>
                <Errors globalLogout="globalLogoutRedirect.html"
                                extGlobalLogoutUrl="{postLogoutURL}" />
</ApplicationOverride>

Native.log
2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : added <PathRegex> mapping (.*)
2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : Added <Host> mapping for https://my.domain.com
2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : Added <Host> mapping for https://my.domain.com:443
2015-06-23 14:57:39 DEBUG Shibboleth.ISAPI [4108] isapi_shib: mapped https://my.domain.com/esas.sso/status to default

Shib.log
2015-06-23 08:58:00 INFO Shibboleth.Listener : registered remoted message endpoint (xyz/saml2/post)
2015-06-23 08:58:00 INFO Shibboleth.Listener : registered remoted message endpoint (xyz::getHeaders::Application)

IIS Log (no sc-win32-status to work with, can't have a failed request trace on http code 200 either)
2015-06-23 18:57:40 xxx.xxx.xxx.xxx GET /esas.sso/status - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:38.0)+Gecko/20100101+Firefox/38.0 200 0 0 2714

Server

Windows Server 2008R2 64bit,
IIS 7.5
Shibboleth SP 2.4.3 64bit,
.Net 2.0 application pool,
32bits flag set to false

Dan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150624/3ea6641a/attachment-0001.html>