SP 3.0.4 IIS module and handlerURL processing

[Rod Widdowson]

https://issues.shibboleth.net/jira/browse/SSPCPP-856

Is the bug and shows the workaround...

Sent from my iPad

> On 25 Mar 2019, at 20:14, Michael Brogan <mbrogan at uw.edu> wrote:
> 
> With SP 2.x and the ISAPI filter, we used application overrides to achieve “step-up” from a password session to 2fa for more sensitive content in a separate directory. The application override for /2fapath created a handler url at /2fapath/Shibboleth2.sso. This had the desired effect of requiring a password authenticated user to provide their second factor (Duo in our case) when they accessed /2fapath.
>  
> With Shib 3.0.4 and the new IIS module, this no longer works. Upon requesting the 2fa content, a correct request is sent to the IdP and a correct response comes back to /2fapath/Shibboleth.sso. But IIS returns a 404 as if the handler wasn’t actually created or the module didn’t handle the response.
>  
> Questions:
> 1.       Is this known to be broken as a result of bug SSPCPP-856?
> 2.       If so, will going back to the ISAPI filter restore the previous application override behavior?
> 3.       If application overrides are deprecated for most use cases, is there a recommended way to achieve “step-up” without application overrides?
>  
> Michael W. Brogan
> Technical Lead, Identity and Access Management
> UW-IT, University of Washington
> 206-685-7521
>  
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190325/5ff7de05/attachment.html>