Application Override in IIS

Fri Apr 13 14:59:06 EDT 2018

rverones,

Your issue is probably that you're relying on the built-in metadata generator rather than mishandling inbound requests, but without a better description of the behavior, it's hard to tell you definitively.

The metadata generator's only intended to give you a baseline to work from.  That baseline happens to be sufficient in most situations, but it's probably not sufficient in your situation.

You'll want to use what the generator spits out as a baseline and then you'll need to modify that by hand to match the reality of your deployment and host it somewhere your customers can access that.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPHandler#NativeSPHandler-MetadataGenerationHandler

https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP

Hope this helps,
Nate.
________________________________
From: users <users-bounces at shibboleth.net> on behalf of rverones <robert at tero.ca>
Sent: Friday, April 13, 2018 11:53:08 AM
To: users at shibboleth.net
Subject: Application Override in IIS

So this question has been asked multiple times with varying responses, all
very similar of course.  We have an issue where we host an application in
IIS (most responses seem to be regarding Apache).

Our initial config of Shib SP is working fine.  We have numerous IIS servers
in various locations and so far each install has worked fine.  However, this
is due to us using the defaults and only having 1 application running that
required SSO.

Now are running into the following where we need to make changes.  I have
added our current shibboleth2.xml statement (clearly with removed customer
details) to give you an idea where we have gone.  We cannot change how our
application is designed or configured in IIS other than adding the details
to allow Shibboleth to operate.

originally we used the applicationdefault entityid for each customer.  Now
we want to use the applicationoverride.

It seemed to be working as our SP was sending back to the customers IDP
correctly.  However when they go to pull the metadata, they said that the
entityid needs to display their site.  I explained that it seems to pull the
default out along with their metadata so I am not sure that is possible.

Each customer site has its own application pool and physical folder.  This
cannot be changed and each site points to customer1.app.com,
customer2.app.com etc...  Technically there is no default (other than having
1 customer per IIS server).

the logs seem to indicate that this loads, but so far the customers cannot
login.  Could be something else we need to do.

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">
<InProcess logger="native.logger">
<ISAPI normalizeRequest="true" safeHeaderNames="true">
<Site id="33" name="customer1.app.com"/>
<Site id="63" name="customer2.app.com"/>
</ISAPI>
</InProcess>
<RequestMapper type="XML">
<RequestMap>
<Host name="customer1.app.com">
<Path name="secure" authType="shibboleth" requireSession="true"
encoding="URL" applicationId="site1"/>
</Host>
<Host name="customer2.app.com">
<Path name="secure" authType="shibboleth" requireSession="true"
encoding="URL" applicationId="site2"/>
</Host>
</RequestMap>
</RequestMapper>

<ApplicationDefaults
<!-- customer 2 does not want to see the default in their metadata -->
entityID="https://ourapp.app.com/Shibboleth"
                         REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

</Sessions>

<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="metadata.xml"
       backingFilePath="metadata.xml" reloadInterval="7200">
</MetadataProvider>
<AttributeExtractor type="XML" file="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

<ApplicationOverride id="site1"
entityID="https://customer1.app.com/Shibboleth"
REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">
<SSO entityID="urn:mace:incommon:site.edu">
SAML2 SAML1
</SSO>

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="site1metadata.xml"
       backingFilePath="site1metadata.xml" reloadInterval="7200">
</MetadataProvider>

<AttributeExtractor type="XML" file="site1-attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>

<ApplicationOverride id="site2"
entityID="https://customer2.app.com/Shibboleth"
 REMOTE_USER="uid eppn persistent-id targeted-id"

cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerURL="/secure/Shibboleth.sso"
handlerSSL="true" cookieProps="https">
<SSO entityID="https://customer2.theirurl.com/idp/shibboleth">
SAML2 SAML1
</SSO>

<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

</Sessions>

<Errors supportContact="support at ourapp.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" file="site2metadata.xml"
       backingFilePath="site2metadata.xml" reloadInterval="7200">
</MetadataProvider>

<AttributeExtractor type="XML" file="site2-attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>

--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180413/31510698/attachment.html>