<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I'm currently trying to debug a handlerUrl not serving up the status or metadata URLs. For instance:
<a href="https://my.domain.com/esas.sso/status">https://my.domain.com/esas.sso/status</a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Note, I am aware of the difference in name and capitalization for handlerUrls. It's intentional and functional in our case (for instance, SiteID 1 & 2 mentioned later).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I'm getting the following error: <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">ISAPI extension can only be invoked to process Shibboleth protocol requests. Make sure the mapped file extension doesn't match actual content.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What I've done:<o:p></o:p></p>
<p class="MsoNormal">- I've made sure permissions were given to the application pool, IUSR and IIS_IUSRS on the folder in question.<o:p></o:p></p>
<p class="MsoNormal">- I've removed and reinstalled (many times) the ISAPI filter and Handler Mappings<o:p></o:p></p>
<p class="MsoNormal">- Changes would have me reboot shibd and iis (in that order)<o:p></o:p></p>
<p class="MsoNormal">- SiteID 1 and 2, not mentionned here, are functional and resolving handlerUrl attributes properly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I've also been searching the mailing list archive for tips and, IMO, exhausted my options. Plus, a quick paste of these config blocks in Apache it works on the first try.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Relevant portions of shibboleth2.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><InProcess logger="native.logger"><o:p></o:p></p>
<p class="MsoNormal"> <ISAPI normalizeRequest="true" safeHeaderNames="true"><o:p></o:p></p>
<p class="MsoNormal"> <Site id="8" name="my.domain.com" scheme="https" port="443" /><o:p></o:p></p>
<p class="MsoNormal"> </ISAPI><o:p></o:p></p>
<p class="MsoNormal"></InProcess><o:p></o:p></p>
<p class="MsoNormal">...<o:p></o:p></p>
<p class="MsoNormal"><Host name="my.domain.com" scheme="https" port="443"><o:p></o:p></p>
<p class="MsoNormal"> <Path name="abc" requireSession="false">
<o:p></o:p></p>
<p class="MsoNormal"> <PathRegex regex=".*" authType="shibboleth"<o:p></o:p></p>
<p class="MsoNormal"> requireSession="true" requireSessionWith="Internet" applicationId="xyz" /><o:p></o:p></p>
<p class="MsoNormal"> </Path>
<o:p></o:p></p>
<p class="MsoNormal"></Host><o:p></o:p></p>
<p class="MsoNormal">...<o:p></o:p></p>
<p class="MsoNormal"><ApplicationOverride id="xyz" entityID="my.id.here" homeURL="<a href="http://my.domain.com">http://my.domain.com</a>"<o:p></o:p></p>
<p class="MsoNormal"> REMOTE_USER="eppn persistent-id targeted-id" signing="true"<o:p></o:p></p>
<p class="MsoNormal"> encryption="false"><o:p></o:p></p>
<p class="MsoNormal"> <!-- cookieProps adding ;secure will only send cookie when it's over https.
<o:p></o:p></p>
<p class="MsoNormal"> Since we were on http, it didn't send it, creates a new session and returns
<o:p></o:p></p>
<p class="MsoNormal"> us on homeURL instead of where we're going --><o:p></o:p></p>
<p class="MsoNormal"> <Sessions lifetime="7200" timeout="1020" checkAddress="false"<o:p></o:p></p>
<p class="MsoNormal"> handlerURL="/esas.sso" handlerSSL="false"<o:p></o:p></p>
<p class="MsoNormal"> cookieProps=";path=/;" exportLocation="<a href="http://localhost/esas.sso/getassertion">http://localhost/esas.sso/getassertion</a>"<o:p></o:p></p>
<p class="MsoNormal"> exportACL="127.0.0.1" idpHistory="false" idpHistoryDays="7"><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService Location="/saml2/post"<o:p></o:p></p>
<p class="MsoNormal"> index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" /><o:p></o:p></p>
<p class="MsoNormal"> </Sessions><o:p></o:p></p>
<p class="MsoNormal"> <Errors globalLogout="globalLogoutRedirect.html"<o:p></o:p></p>
<p class="MsoNormal"> extGlobalLogoutUrl="{postLogoutURL}" /><o:p></o:p></p>
<p class="MsoNormal"></ApplicationOverride><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Native.log<o:p></o:p></p>
<p class="MsoNormal">2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : added <PathRegex> mapping (.*)<o:p></o:p></p>
<p class="MsoNormal">2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : Added <Host> mapping for
<a href="https://my.domain.com">https://my.domain.com</a><o:p></o:p></p>
<p class="MsoNormal">2015-06-23 14:57:39 DEBUG Shibboleth.RequestMapper : Added <Host> mapping for
<a href="https://my.domain.com:443">https://my.domain.com:443</a><o:p></o:p></p>
<p class="MsoNormal">2015-06-23 14:57:39 DEBUG Shibboleth.ISAPI [4108] isapi_shib: mapped
<a href="https://my.domain.com/esas.sso/status">https://my.domain.com/esas.sso/status</a> to default<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Shib.log<o:p></o:p></p>
<p class="MsoNormal">2015-06-23 08:58:00 INFO Shibboleth.Listener : registered remoted message endpoint (xyz/saml2/post)<o:p></o:p></p>
<p class="MsoNormal">2015-06-23 08:58:00 INFO Shibboleth.Listener : registered remoted message endpoint (xyz::getHeaders::Application)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">IIS Log (no sc-win32-status to work with, can’t have a failed request trace on http code 200 either)<o:p></o:p></p>
<p class="MsoNormal">2015-06-23 18:57:40 xxx.xxx.xxx.xxx GET /esas.sso/status - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:38.0)+Gecko/20100101+Firefox/38.0 200 0 0 2714<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Server<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Windows Server 2008R2 64bit, <o:p></o:p></p>
<p class="MsoNormal">IIS 7.5<o:p></o:p></p>
<p class="MsoNormal">Shibboleth SP 2.4.3 64bit, <o:p></o:p></p>
<p class="MsoNormal">.Net 2.0 application pool, <o:p></o:p></p>
<p class="MsoNormal">32bits flag set to false<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dan<span style="mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>