issue with IIS application integration

[Cantor, Scott]

> The app developer assigned to the integration keeps wanting to manually
> redirect to https://vendor.com/Shibboleth.sso/Login to initiate the login
> process.  I've only ever triggered session initiation by accessing a protected
> path.  Should an app ever trigger the session initiator directly?

Sometimes, sure, it depends on the integration strategy. It doesn't mean the app is going to be able to do what it needs to do. 

> I added /secure/ - which is just a folder w/ an index.htm file
> I added that path to the host definition in shibboleth2.xml and bounced iis,
> and requests for /secure/ DO invoke the sp.

That eliminates most of the "usual" sorts of problems.

> One of our local IIS admins suggested to check and make sure that the
> version of .NET is the same as the version of the ISAPI filter (32bit vs 64bit).

When you have a .NET app, that does cross over into "AppPool" territory and yes, that's a pretty common issue. It's not the .NET version, it's the AppPool settings that determine the architecture it runs under.

> Any other suggestions?

That's the most common issue given a site where other things are working.

-- Scott