IIS setup

[Dave Perry]

Thanks Scott - those two details have fixed most of the issues.

In case anyone else has got this running as I'm trying to achieve...has anyone got each Site on its own entityID AND having its own metadata? Azure unfortunately will demand this (and I'll need to leverage Azure app permissions to restrict each app to different groups of users - as we roll out IdM, we want AAD groups to police access as much as possible).

(I've seen the note that multiple entityIDs for SSO isn't a good idea, but unless I'm missing something about how to deal with this I don't have a choice).

TIA

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk/>

[cid:1a53c815-6869-478a-b4e2-5f7e4eca3e98]

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: 14 November 2023 17:30
To: users at shibboleth.net <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: IIS setup

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.


Back to list (and this is it, see footer).

> 1, Azure is not auto-detecting if I have a session already. I have to login
> every time I try to access the webapp (hopefully a setting that can resolve
> this?)

Unless you manually decided to turn on ForceAuthn, that's not an SP issue, it's the IdP deciding to do that.

> 2, When I've signed in successfully, I get a 404 error when hitting
> siteurl.domain.com/Shibboleth.sso (screenshot attached).

Generally means SSL offloading or other forms of virtualization (which IIS does not support, again, it's broken), which requires manipulation of the settings in the Site element.

e.g., The handlerSSL flag set to true, but the requests are over http without TLS so it treats them as standard requests and passes them by.

> The <ApplicationDefaults> entityID setting in shibboleth2.xml is based on
> the name of the server itself.  Is there a better way of setting this up, so you
> use the same IdP for any webapp protected by shibboleth but have
> multiple webapps (each under their own IIS site, with their own Azure
> application to handle the different URLs idea)?

If you're asking if you can apply a different entityID to the SP itself per vhost, yes, the entityIDSelf setting can be set in the <Host> element to apply a different name automatically. It can also be pattern-driven if the hosts are named well enough for input into generating decent entityIDs.

-- Scott


--
For Consortium Member technical support, see https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cd.perry1%40yorksj.ac.uk%7C7f9f8237f8bb40c9d47d08dbe5376d9b%7C5c8ae38ef85b4309b7ec862815a37aee%7C0%7C0%7C638355798442797706%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zlLF6x%2BKvsOuQjlA0FXPy280YYTgN3GmmZotrezpocs%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231115/bd00451f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-e1ctiimc.png
Type: image/png
Size: 12155 bytes
Desc: Outlook-e1ctiimc.png
URL: <http://shibboleth.net/pipermail/users/attachments/20231115/bd00451f/attachment.png>