IIS7 SP Doesn't activate on protected Path

[Don Faulkner]

Trying to Shibbolize a single site on an IIS7 host. Details below. The problem is:

If I go to https://default-site/secure, then I get sent to my IdP for authentication
If I go to https://site-to-protect/secure, then I fall straight through to my default.aspx file with no bounce to IdP and no shib variables.

I’ve tried other sites beside the site I’m interested in with the same results. I’ve configured IIS7 per the instructions in the wiki. To be sure, I bootstrapped a clean VM and tried again. To my dismay, this second VM works fine! So, I’m left wondering what odd thing in IIS is preventing the site from working.

What am I missing?

-----
Versions

IIS7, with many many sites. I’m protecting siteid=26, “myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>” [1]
Shibboleth SP 2.5.3
dual-stack IPv4 and IPv6. Names registered in IPv4 DNS only


-----
shibboleth2.xml (relavent bits)

<InProcess logger=“native.logger”>
<ISAPI normalizeRequest=“true” safeHeaderNames=“true”>
<Site id=“1” name=“www1-clone.uark.edu<http://www1-clone.uark.edu>”/>
<Site id=“26” name=“myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>”/>
</ISAPI>
</InProcess>

<RequestMapper type=“Native”>
<RequestMap>
<Host name=“www1-clone.uark.edu<http://www1-clone.uark.edu>”>
<Path name=“secure” authType=“shibboleth” requireSession=“true”/>
</Host>
<Host name=“myparkingaccount-clone.uark.edu<http://myparkingaccount-clone.uark.edu>”>
<Path name=“secure” authType=“shibboleth” requireSession=“true”/>
</Host>
</RequestMap>
</RequestMapper>

<ApplicationDefaults entityID=“https://www1-clone.uark.edu/shibboleth” REMOTE_USER=“uid eppn persistent-id targeted-id”>
<SSO entityID=“https://idp.uark.edu/idp/shibboleth”>
SAML2
</SSO>
<MetadataProvider type=“XML” uri=“https://federation.uark.edu/metadata/uark-identity-metadata.xml”
backingFilePath=“uark-identity-metadata.xml” reloadInterval=“7200”>
</MetadataProvider>
</ApplicationDefaults>




[1] Please don’t flame me for poor DNS choices. It’s out of my control.
--
[http://goo.gl/2ZYiQ] Don Faulkner, CISSP | CISO<http://security.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf-***@public.gmane.org<mailto:donf-***@public.gmane.org> | [phone]
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>

[Cantor, Scott]

I¹ve tried other sites beside the site I¹m interested in with the same
results. I¹ve configured IIS7 per the instructions in the wiki. To be
sure, I bootstrapped a clean VM and tried again. To my dismay, this
second VM works fine! So, I¹m left wondering what odd thing in IIS is
preventing the site from working.

The canonical doc is [1], but that's mostly pre-IIS7 detail. With 7, it's
fairly likely you don't have the filter configured at the global level or
for reasons I couldn't tell you it has to be configured at the per-site
level and it's not configured there. Assuming the site is properly mapped
anyway.

My experience with newer versions is that the filter only works per-site
and has to be explicitly added on every one.

-- Scott

[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPWontProtect

[Don Faulkner]

On Aug 25, 2014, at 3:19 PM, Cantor, Scott <cantor.2-ZbGKxL/***@public.gmane.org<mailto:***@osu.edu>> wrote:


My experience with newer versions is that the filter only works per-site
and has to be explicitly added on every one.

-- Scott

[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPWontProtect

It’s working. Our issue turned out to be that the Application Pool for the site in question had the setting “Enable 32-bit Applications” set to FALSE, when we were using the 32-bit library (for other reasons). Flip the switch to TRUE, and everything worked.

--
[http://goo.gl/2ZYiQ] Don Faulkner, CISSP | CISO<http://security.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf-***@public.gmane.org<mailto:donf-***@public.gmane.org> | [phone]
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>