IIS setup

[Cantor, Scott]

Back to list (and this is it, see footer).

> 1, Azure is not auto-detecting if I have a session already. I have to login
> every time I try to access the webapp (hopefully a setting that can resolve
> this?)

Unless you manually decided to turn on ForceAuthn, that's not an SP issue, it's the IdP deciding to do that.

> 2, When I've signed in successfully, I get a 404 error when hitting
> siteurl.domain.com/Shibboleth.sso (screenshot attached).

Generally means SSL offloading or other forms of virtualization (which IIS does not support, again, it's broken), which requires manipulation of the settings in the Site element.

e.g., The handlerSSL flag set to true, but the requests are over http without TLS so it treats them as standard requests and passes them by.

> The <ApplicationDefaults> entityID setting in shibboleth2.xml is based on 
> the name of the server itself.  Is there a better way of setting this up, so you
> use the same IdP for any webapp protected by shibboleth but have
> multiple webapps (each under their own IIS site, with their own Azure
> application to handle the different URLs idea)?

If you're asking if you can apply a different entityID to the SP itself per vhost, yes, the entityIDSelf setting can be set in the <Host> element to apply a different name automatically. It can also be pattern-driven if the hosts are named well enough for input into generating decent entityIDs.

-- Scott