<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would like to know if anyone can help with this error wiht the POST handler<o:p></o:p></p>
<p class="MsoNormal">Whenever I go to:<o:p></o:p></p>
<p class="MsoNormal">https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST<o:p></o:p></p>
<p class="MsoNormal">https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST<o:p></o:p></p>
<p class="MsoNormal">https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I get:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">"Shibboleth Error<o:p></o:p></p>
<p class="MsoNormal">ISAPI extension can only be invoked to process Shibboleth protocol requests.<o:p></o:p></p>
<p class="MsoNormal">Make sure the mapped file extension doesn't match actual content."<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I noticed it's a common error and found some threads which I perhaps need to check:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Check if you have configured the following in the shibboleth2.xml<o:p></o:p></p>
<p class="MsoNormal">1. Site Id with correct id and name (IP address) OK <o:p></o:p></p>
<p class="MsoNormal">2. Handler with correct IP address and context - NOt sure what this means the HandlerURL?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am Using IIS7 on a Windows Server 2008 (server computer name medweb.ad.med.miami.edu).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This my partial Shibboleth2.xml (I want to protect 3 different sites hosted in the same server medweb.ad.med.miami.edu)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <InProcess logger="native.logger"><o:p></o:p></p>
<p class="MsoNormal"> <ISAPI normalizeRequest="true" safeHeaderNames="true"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <Site id="1" name="medweb.ad.med.miami.edu" scheme="https" port="443" /><o:p></o:p></p>
<p class="MsoNormal"> <Site id="208" name="restrict1.uresearch.miami.edu" scheme="https" port="443" /><o:p></o:p></p>
<p class="MsoNormal"> <Site id="209" name="restrict2.uresearch.miami.edu" scheme="https" port="443" /><o:p></o:p></p>
<p class="MsoNormal"> <Site id="210" name="restrict3.uresearch.miami.edu" scheme="https" port="443" /><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> </ISAPI><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <RequestMapper type="Native"><o:p></o:p></p>
<p class="MsoNormal"> <RequestMap><o:p></o:p></p>
<p class="MsoNormal"> <Host name="medweb.ad.med.miami.edu"><o:p></o:p></p>
<p class="MsoNormal"> <Path name="secure" authType="shibboleth" requireSession="true"/><o:p></o:p></p>
<p class="MsoNormal"> </Host><o:p></o:p></p>
<p class="MsoNormal"> <Host name="restrict1.uresearch.miami.edu" authType="shibboleth" requireSession="true"/><o:p></o:p></p>
<p class="MsoNormal"> <Host name="restrict2.uresearch.miami.edu" authType="shibboleth" requireSession="true"/><o:p></o:p></p>
<p class="MsoNormal"> <Host name="restrict3.uresearch.miami.edu" authType="shibboleth" requireSession="true"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And this is all I have. I don't have ApplicationOverride to override any ApplicationID's or
<o:p></o:p></p>
<p class="MsoNormal">anything like that.<o:p></o:p></p>
<p class="MsoNormal">I just added to my metadata all redirects:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_bdab8d7cef943726ec06ad1efa72ae451ca98b7e" entityID="https://restrict1.uresearch.miami.edu"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"><o:p></o:p></p>
<p class="MsoNormal"> <md:Extensions><o:p></o:p></p>
<p class="MsoNormal"> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://medweb.ad.med.miami.edu/Shibboleth.sso/Login"/><o:p></o:p></p>
<p class="MsoNormal"> </md:Extensions><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://restrict1.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="1"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="1"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="3"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="4"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="5"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict1.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="6"/><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="10"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="10"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="20"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="30"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="40"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="50"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict2.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="60"/><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/Artifact/SOAP" index="100"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/SOAP"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/Redirect"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/POST"/><o:p></o:p></p>
<p class="MsoNormal"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SLO/Artifact"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST" index="100"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="200"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/Artifact" index="300"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML2/ECP" index="400"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML/POST" index="500"/><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://restrict3.uresearch.miami.edu/Shibboleth.sso/SAML/Artifact" index="600"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Not sure why I am getting that error when I have my IIS ISAPI filters set up.
<o:p></o:p></p>
<p class="MsoNormal">It is last in the list of ISAPI filters in IIS, I made sure it maps to:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Name Executable<o:p></o:p></p>
<p class="MsoNormal">Shibboleth C:\opt\shibobleth-sp\lib64\shiboleth\isapi_shib.dll<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I also checked the Shib IdP logs, the native log in the SP and didn't find any errors.<o:p></o:p></p>
<p class="MsoNormal">Perhaps I need to open up more DEBUG?<o:p></o:p></p>
<p class="MsoNormal">I still don't understand what is the issue.<o:p></o:p></p>
<p class="MsoNormal">I noticed someone talked about the part of the session tags, which I don’t have the handleURL.
<o:p></o:p></p>
<p class="MsoNormal">My Session tag looks like:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<o:p></o:p></p>
<p class="MsoNormal"> checkAddress="false" handlerSSL="false" cookieProps="http"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I thought it would default to /Shibboleth.sso anyways.<o:p></o:p></p>
<p class="MsoNormal">I'd appreciate anyone pointing me in the right direction.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Dyana Alvarez<o:p></o:p></p>
</div>
</body>
</html>