Shibboleth & IIS

[Boyd, Todd M.]

Enable trace logging and you may find that it's IIS that is sending the 401. Try enabling anonymous authentication on the site to see if you're still getting the 401 code. You don't need to use standard IIS authorization mechanism when the SP is sitting in front of your traffic. In fact, doing so will likely interfere with it.

I wrote a simple HTTP module that converts Shibboleth SAML attributes back to Prinicipals for the logged-in user and their group memberships so that we can still apply authorization filters, but even then we have to leave Anonymous enabled as our authentication method.


-Todd


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Gordon Ross
Sent: Sunday, February 24, 2019 3:56 PM
To: Shib Users <users at shibboleth.net>
Subject: Shibboleth & IIS

CAUTION!: This email originated from outside of Columbia College.


I’ve got a simple IIS/Shibboleth setup. When I try to access /secure/ I’m getting a “401 - Unauthorized: Access is denied due to invalid credentials” after coming back from authenticating with my idP.

In my shibboleth2.xml file I’ve got pretty much the default:

<RequestMapper type="Native">
        <RequestMap>
            <Host name=“www.example.org">
                <Path name="secure" authType="shibboleth" requireSession="true"/>
            </Host>
        </RequestMap>
    </RequestMapper>

I’ve changed the default logging to DEBUG (as per the Shib troubleshooting page) I’ve had a look in the Shib. log files, but I’m not seeing any obvious clues in there.

Any suggestions as to how to troubleshoot/fix this?

Thanks,

Gordon.
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net