Application Override in IIS

Fri Apr 13 14:53:08 EDT 2018

So this question has been asked multiple times with varying responses, all
very similar of course.  We have an issue where we host an application in
IIS (most responses seem to be regarding Apache).

Our initial config of Shib SP is working fine.  We have numerous IIS servers
in various locations and so far each install has worked fine.  However, this
is due to us using the defaults and only having 1 application running that
required SSO.

Now are running into the following where we need to make changes.  I have
added our current shibboleth2.xml statement (clearly with removed customer
details) to give you an idea where we have gone.  We cannot change how our
application is designed or configured in IIS other than adding the details
to allow Shibboleth to operate.

originally we used the applicationdefault entityid for each customer.  Now
we want to use the applicationoverride.

It seemed to be working as our SP was sending back to the customers IDP
correctly.  However when they go to pull the metadata, they said that the
entityid needs to display their site.  I explained that it seems to pull the
default out along with their metadata so I am not sure that is possible.

Each customer site has its own application pool and physical folder.  This
cannot be changed and each site points to customer1.app.com,
customer2.app.com etc...  Technically there is no default (other than having
1 customer per IIS server).

the logs seem to indicate that this loads, but so far the customers cannot
login.  Could be something else we need to do.

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">
<InProcess logger="native.logger">
<ISAPI normalizeRequest="true" safeHeaderNames="true">
<Site id="33" name="customer1.app.com"/>
<Site id="63" name="customer2.app.com"/>
</ISAPI>
</InProcess>
<RequestMapper type="XML">
<RequestMap>
<Host name="customer1.app.com">
<Path name="secure" authType="shibboleth" requireSession="true"
encoding="URL" applicationId="site1"/> 
</Host>
<Host name="customer2.app.com">
<Path name="secure" authType="shibboleth" requireSession="true"
encoding="URL" applicationId="site2"/> 
</Host>
</RequestMap>
</RequestMapper>

<ApplicationDefaults 
<!-- customer 2 does not want to see the default in their metadata -->
entityID="https://ourapp.app.com/Shibboleth"
			 REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

</Sessions> 

<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="metadata.xml"
       backingFilePath="metadata.xml" reloadInterval="7200">
</MetadataProvider>
<AttributeExtractor type="XML" file="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

<ApplicationOverride id="site1"
entityID="https://customer1.app.com/Shibboleth"
REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">
<SSO entityID="urn:mace:incommon:site.edu">
SAML2 SAML1
</SSO>

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="site1metadata.xml"
       backingFilePath="site1metadata.xml" reloadInterval="7200">
</MetadataProvider>

<AttributeExtractor type="XML" file="site1-attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>

<ApplicationOverride id="site2"
entityID="https://customer2.app.com/Shibboleth"
 REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerURL="/secure/Shibboleth.sso"
handlerSSL="true" cookieProps="https">
<SSO entityID="https://customer2.theirurl.com/idp/shibboleth">
SAML2 SAML1
</SSO>

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

</Sessions>

<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="site2metadata.xml"
       backingFilePath="site2metadata.xml" reloadInterval="7200">
</MetadataProvider>

<AttributeExtractor type="XML" file="site2-attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>

--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html