SP 3.0.4 IIS module and handlerURL processing

[Michael Brogan]

My understanding of the work-around from the Jira card is that <ISAPI handlerPrefix=”/path/shibboleth.sso”>  can be used to move the default handler from one path to another. In the case I’m working on, there are multiple application overrides, each with their own handler in the appropriate path. I don’t understand how to apply the work around in that case. Or can “handlerPrefix” also be set within an application override?

--Michael

From: users <users-bounces at shibboleth.net> On Behalf Of Rod Widdowson
Sent: Monday, March 25, 2019 1:26 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP 3.0.4 IIS module and handlerURL processing

https://issues.shibboleth.net/jira/browse/SSPCPP-856<https://issues.shibboleth.net/jira/browse/SSPCPP-856?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel&focusedCommentId=29885>

Is the bug and shows the workaround...
Sent from my iPad

On 25 Mar 2019, at 20:14, Michael Brogan <mbrogan at uw.edu<mailto:mbrogan at uw.edu>> wrote:
With SP 2.x and the ISAPI filter, we used application overrides to achieve “step-up” from a password session to 2fa for more sensitive content in a separate directory. The application override for /2fapath created a handler url at /2fapath/Shibboleth2.sso. This had the desired effect of requiring a password authenticated user to provide their second factor (Duo in our case) when they accessed /2fapath.

With Shib 3.0.4 and the new IIS module, this no longer works. Upon requesting the 2fa content, a correct request is sent to the IdP and a correct response comes back to /2fapath/Shibboleth.sso. But IIS returns a 404 as if the handler wasn’t actually created or the module didn’t handle the response.

Questions:

1.       Is this known to be broken as a result of bug SSPCPP-856?

2.       If so, will going back to the ISAPI filter restore the previous application override behavior?

3.       If application overrides are deprecated for most use cases, is there a recommended way to achieve “step-up” without application overrides?

Michael W. Brogan
Technical Lead, Identity and Access Management
UW-IT, University of Washington
206-685-7521

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190325/bc62341c/attachment.html>