IIS 7 rewrite shibboleth authentication looping.

[Austin, Gary D]

Maybe I did not explain myself correctly.  When we disable shibboleth on IIS all of our applications rewrite to the correct internal servers and the applications work.  When we turn on Shibboleth we consistently go through the looping I described.  If we turn off the rewrites rules in IIS and view the environment variables we see all the Shibboleth information like Shib-Session-ID.  When we turn the rewrite rules on and view the rewrite logs no shibboleth headers are seen.  All the standard headers are there just not the shibboleth ones we saw without the rewrite rules turned on.  I am thinking that I need to add a variable to the rewrite rules to keep the header information.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, April 12, 2018 12:09 PM
To: Shib Users <users at shibboleth.net>
Subject: EXTERNAL: RE: IIS 7 rewrite shibboleth authentication looping.

> We have a windows server running IIS7 and Shibboleth SP 2.6.4.  The 
> windows server is used as a proxy but we want authentication to occur 
> before proxying request to another backend server.  We have set up the 
> Shibboleth SP and get prompted correctly for our information but once 
> we have authenticated it appears during the rewrite, the shibboleth 
> session information is not being redirected during the rewrite.

I don't know what you think that means, but there is nothing redirected, every request is directly evaluated by the filter and information attached or not, and looping indicates cookie mismatches or issues that result in failure to revalidate and locate the session for the subsequent request(s) and then a re-init of the login loop. The wiki discusses common causes and only HTTP tracing can ultimately locate the issue.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net