0

I am using shibboleth SP 3 and IIS 8 on one server. I protect a folder "secure" and redirects to a test ADFS, where I configured the extraction of the UPN from the AD.

My attribute-map.xml looks like this:

<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" id="UPN" />
</Attributes>

Everything works fine. I check the http headers and server variables, all the custom shibboleth headers are there and corresponding server variables with the prefix HTTP_

I am deploying this on a test server, Windows Server 2012 with IIS 8. My problem is, I still have the server variables, but without the HTTP_ prefix, and I don't have the HTTP headers any longer, while my app relies on them.

The configuration files are almost identical. I have dug in the Shibboleth SP wiki, which is a murder to read, I don't find where I can finetune how the attributes are added in HTTP headers or server variables.

Do you have any clue?

thanks.

Joel
  • 669
  • 7
  • 25

1 Answers1

1

Shibboleth SP 3 uses the new iis7_shib.dll instead of the old isapi_shib.dll and it no longer populates the headers by default. See https://wiki.shibboleth.net/confluence/display/SP3/IIS#IIS-NewVersioninV3oftheSP.

However, you can edit the <ISAPI> element to useHeaders... see: https://wiki.shibboleth.net/confluence/display/SP3/ISAPI for documentation, but it should be as simple as replacing

<ISAPI>

with

<ISAPI useHeaders="true">

within your shibboleth2.xml file.

Kellen Murphy
  • 620
  • 6
  • 13
  • 1
    Thanks, indeed it works with isapi_shib.dll. Someone from the test team removed the isapi filter while the handler module was still working. Adding the ISAPI filter made it worked. – Joel Mar 05 '19 at 10:15
  • That might be a temporary solution. I expect *eventually* that `isapi_shib.dll` will go away, though that's likely to be so far in the future that it might not really affect you. – Kellen Murphy Mar 05 '19 at 18:10