Shibboleth 3, IIS 8.5 Server 2012 Crashing Application Pool

[Cantor, Scott]

On 12/6/19, 3:12 PM, "users on behalf of RaymondFord" <users-bounces at shibboleth.net on behalf of rtford at techcom.com> wrote:

> The issue was with the newest version of Shibboleth, 3.0.4.
> I uninstalled 3.0.4 and installed 3.0.3 and everything started working properly.

Whatever the uninstall/reinstall did probably fixed an issue that has nothing to do with that update, and you're now on a version with a trivial denial of service bug in it.

The only issue known to cause crashes in 3.0.4 is just as broken in 3.0.3, the cookie session recovery feature. There are hardly any changes at all in that patch, and nothing on the IIS side.

Most crashes on the app pool side that aren't DLL conflicts are usually permission-related.
 
-- Scott