ISAPI extension can only be invoked to process Shibboleth protocol requests

[Cantor, Scott]

On 6/24/15, 3:40 PM, "users on behalf of Fournier, Danny G" <users-bounces at shibboleth.net on behalf of Danny.Fournier at dfo-mpo.gc.ca> wrote:



> 
>- I've removed and reinstalled (many times) the ISAPI filter and Handler Mappings

That has the impact of making IIS lie more and more about what's actually in place. But the issue isn't any of that, if the mappings weren't there, you couldn't get that error.

The problem is using application overrides improperly.

>I've also been searching the mailing list archive for tips and, IMO, exhausted my options. Plus, a quick paste of these config blocks in Apache it works on the first try.

They wouldn't, not in isolation anyway. It certainly wouldn't login successfully, it would probably loop.

> 
><Host name="my.domain.com" scheme="https" port="443">
>                <Path name="abc" requireSession="false">                      
>
>                                <PathRegex regex=".*" authType="shibboleth"
>                                                requireSession="true" requireSessionWith="Internet" applicationId="xyz" />

You're mapping what's below /abc to that applicationId, but you haven't put the handlerURL there, so it's not going to map to that applicationId. Basic mistake.

All of this is almost certainly unnecessary and far more complex than it needs to be, but that's the error.

requireSessionWith, for example, is pretty much never needed, that's a very old setting that's been superseded in a variety of ways. It's just a signal that something is fishy. It's possible there's just material elided, but there isn't a SessionInitiator inside that override by that name, so that suggests other problems are lurking.

-- Scott