SP 3.0.4 IIS module and handlerURL processing

[Michael Brogan]

With SP 2.x and the ISAPI filter, we used application overrides to achieve "step-up" from a password session to 2fa for more sensitive content in a separate directory. The application override for /2fapath created a handler url at /2fapath/Shibboleth2.sso. This had the desired effect of requiring a password authenticated user to provide their second factor (Duo in our case) when they accessed /2fapath.

With Shib 3.0.4 and the new IIS module, this no longer works. Upon requesting the 2fa content, a correct request is sent to the IdP and a correct response comes back to /2fapath/Shibboleth.sso. But IIS returns a 404 as if the handler wasn't actually created or the module didn't handle the response.

Questions:

1.       Is this known to be broken as a result of bug SSPCPP-856?

2.       If so, will going back to the ISAPI filter restore the previous application override behavior?

3.       If application overrides are deprecated for most use cases, is there a recommended way to achieve "step-up" without application overrides?

Michael W. Brogan
Technical Lead, Identity and Access Management
UW-IT, University of Washington
206-685-7521

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190325/bf27933e/attachment.html>