<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
rverones,
<div><br>
</div>
<div>Your issue is probably that you're relying on the built-in metadata generator rather than mishandling inbound requests, but without a better description of the behavior, it's hard to tell you definitively.</div>
<div><br>
</div>
<div>The metadata generator's only intended to give you a baseline to work from. That baseline happens to be sufficient in most situations, but it's probably not sufficient in your situation.</div>
<div><br>
</div>
<div>You'll want to use what the generator spits out as a baseline and then you'll need to modify that by hand to match the reality of your deployment and host it somewhere your customers can access that.</div>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPHandler#NativeSPHandler-MetadataGenerationHandler" class="OWAAutoLink" id="LPlnk836241" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPHandler#NativeSPHandler-MetadataGenerationHandler</a><br>
</div>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP" class="OWAAutoLink" id="LPlnk118525" previewremoved="true">https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP</a><br>
</div>
<div><br>
</div>
<div>Hope this helps,</div>
<div>Nate.</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of rverones <robert@tero.ca><br>
<b>Sent:</b> Friday, April 13, 2018 11:53:08 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Application Override in IIS</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">So this question has been asked multiple times with varying responses, all<br>
very similar of course. We have an issue where we host an application in<br>
IIS (most responses seem to be regarding Apache).<br>
<br>
Our initial config of Shib SP is working fine. We have numerous IIS servers<br>
in various locations and so far each install has worked fine. However, this<br>
is due to us using the defaults and only having 1 application running that<br>
required SSO.<br>
<br>
Now are running into the following where we need to make changes. I have<br>
added our current shibboleth2.xml statement (clearly with removed customer<br>
details) to give you an idea where we have gone. We cannot change how our<br>
application is designed or configured in IIS other than adding the details<br>
to allow Shibboleth to operate.<br>
<br>
originally we used the applicationdefault entityid for each customer. Now<br>
we want to use the applicationoverride.<br>
<br>
It seemed to be working as our SP was sending back to the customers IDP<br>
correctly. However when they go to pull the metadata, they said that the<br>
entityid needs to display their site. I explained that it seems to pull the<br>
default out along with their metadata so I am not sure that is possible.<br>
<br>
Each customer site has its own application pool and physical folder. This<br>
cannot be changed and each site points to customer1.app.com,<br>
customer2.app.com etc... Technically there is no default (other than having<br>
1 customer per IIS server).<br>
<br>
the logs seem to indicate that this loads, but so far the customers cannot<br>
login. Could be something else we need to do.<br>
<br>
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br>
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br>
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br>
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" <br>
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
clockSkew="180"><br>
<InProcess logger="native.logger"><br>
<ISAPI normalizeRequest="true" safeHeaderNames="true"><br>
<Site id="33" name="customer1.app.com"/><br>
<Site id="63" name="customer2.app.com"/><br>
</ISAPI><br>
</InProcess><br>
<RequestMapper type="XML"><br>
<RequestMap><br>
<Host name="customer1.app.com"><br>
<Path name="secure" authType="shibboleth" requireSession="true"<br>
encoding="URL" applicationId="site1"/> <br>
</Host><br>
<Host name="customer2.app.com"><br>
<Path name="secure" authType="shibboleth" requireSession="true"<br>
encoding="URL" applicationId="site2"/> <br>
</Host><br>
</RequestMap><br>
</RequestMapper><br>
<br>
<ApplicationDefaults <br>
<!-- customer 2 does not want to see the default in their metadata --><br>
entityID="<a href="https://ourapp.app.com/Shibboleth">https://ourapp.app.com/Shibboleth</a>"<br>
REMOTE_USER="uid eppn persistent-id targeted-id"<br>
<br>
cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2"><br>
<br>
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br>
checkAddress="false" handlerSSL="true"<br>
cookieProps="https"><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<Logout>SAML2 Local</Logout><br>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br>
<Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br>
<br>
<br>
</Sessions> <br>
<br>
<Errors supportContact="support@ourapp.com"<br>
helpLocation="/about.html"<br>
styleSheet="/shibboleth-sp/main.css"/><br>
<MetadataProvider type="XML" file="metadata.xml"<br>
backingFilePath="metadata.xml" reloadInterval="7200"><br>
</MetadataProvider><br>
<AttributeExtractor type="XML" file="attribute-map.xml"/><br>
<AttributeResolver type="Query" subjectMatch="true"/><br>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br>
<br>
<br>
<ApplicationOverride id="site1"<br>
entityID="<a href="https://customer1.app.com/Shibboleth">https://customer1.app.com/Shibboleth</a>"<br>
REMOTE_USER="uid eppn persistent-id targeted-id"<br>
<br>
cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2"><br>
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br>
checkAddress="false" handlerSSL="true"<br>
cookieProps="https"><br>
<SSO entityID="urn:mace:incommon:site.edu"><br>
SAML2 SAML1<br>
</SSO><br>
<br>
<Logout>SAML2 Local</Logout><br>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br>
<Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br>
</Sessions><br>
<Errors supportContact="support@ourapp.com"<br>
helpLocation="/about.html"<br>
styleSheet="/shibboleth-sp/main.css"/><br>
<MetadataProvider type="XML" file="site1metadata.xml"<br>
backingFilePath="site1metadata.xml" reloadInterval="7200"><br>
</MetadataProvider><br>
<br>
<AttributeExtractor type="XML" file="site1-attribute-map.xml"/><br>
<AttributeResolver type="Query" subjectMatch="true"/><br>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br>
</ApplicationOverride><br>
<br>
<br>
<br>
<br>
<ApplicationOverride id="site2"<br>
entityID="<a href="https://customer2.app.com/Shibboleth">https://customer2.app.com/Shibboleth</a>"<br>
REMOTE_USER="uid eppn persistent-id targeted-id"<br>
<br>
cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2"><br>
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br>
checkAddress="false" handlerURL="/secure/Shibboleth.sso"<br>
handlerSSL="true" cookieProps="https"><br>
<SSO entityID="<a href="https://customer2.theirurl.com/idp/shibboleth">https://customer2.theirurl.com/idp/shibboleth</a>"><br>
SAML2 SAML1<br>
</SSO><br>
<br>
<br>
<br>
<Logout>SAML2 Local</Logout><br>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br>
<Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br>
<br>
<br>
</Sessions><br>
<br>
<Errors supportContact="support@ourapp.com"<br>
helpLocation="/about.html"<br>
styleSheet="/shibboleth-sp/main.css"/><br>
<MetadataProvider type="XML" file="site2metadata.xml"<br>
backingFilePath="site2metadata.xml" reloadInterval="7200"><br>
</MetadataProvider><br>
<br>
<AttributeExtractor type="XML" file="site2-attribute-map.xml"/><br>
<AttributeResolver type="Query" subjectMatch="true"/><br>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br>
</ApplicationOverride><br>
</ApplicationDefaults><br>
<SecurityPolicyProvider type="XML" validate="true"<br>
path="security-policy.xml"/><br>
<ProtocolProvider type="XML" validate="true" reloadChanges="false"<br>
path="protocols.xml"/><br>
</SPConfig><br>
<br>
<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">
http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>