Shibboleth ISAPI Filter warning message

[Cantor, Scott]

On 11/3/17, 5:32 PM, "users on behalf of Franchuk, Vlad" <users-bounces at shibboleth.net on behalf of vlad.franchuk at ubc.ca> wrote:

> Thank you for your quick response. The "Shibboleth 2 Daemon (Default)" service is running under Local System account.

It doesn't write to native.log, it writes to shibd.log.

> Should I grant Full control or Modify permission for some other accounts (like IIS_IUSRS user group) for the same
> folder/subfolders on the web application server?

You should grant control over native.log to all of the accounts that the module/filter happens to run as, and that's not in the same folder used by shibd for its logs, and you definitely shouldn't give those accounts read access to the private key in etc/

On a normal Windows box, all of this is pretty automatic, so there's something not normal about the IIS app account(s).

-- Scott