Shibboleth SP not protecting site its set for

[Cantor, Scott]

Your host element is wrong, the port is not part of the name. There are separate XML attributes for scheme and port, but that is unlikely to matter because if the site is virtualized, the logical port is probably 443 anyway and the problem is elsewhere. The RequestMap is based on the logical, not the physical.

Virtualizing IIS is not advised as it is not supported, but if you insist on it, the SP's ISAPI element and the Site element inside it are the way to do that, they do what ServerName does on Apache to virtualize the reported information about the request.

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2063696262

-- Scott