4

We are trying to use ASP.Net MVC with Siteminder for Single Sign on. This is on Windows Server 2008 R2 with IIS 7.5. Siteminder Agent version 6QMR6.

Problem : Siteminder protects physical files that are exist. And it is not protecting the folder when we try to access a non existed file. It must redirect to login page even if the file doesn't exist when the user is accessing a protected folder.

How to configure in IIS 7.5 that Do not verify a file exist, before authentication by siteminder. SiteMinderWebAgent is a Handler(WildCard Script Map) we created using the ISAPI6WebAgent.dll

How to Protect ASP.Net MVC Request with Siteminder? (Added this as My previous question did not solve the problem). MVC Request shows up in IIS Log but not in Siteminder log.

Update : Microsoft Support says currently IIS7.5, even in earlier versions doesnt support wildcard mappings on any two Isapi Handlers with * wild card. Currently in my case Siteminder has * wildcard and asp.net mvc (handler is aspnet_isapi) has * wildcard to handle the reqeusts. Ordered priority doesnt work in the wild card mappings case with Just *. Did not convinced with the answer but will wait till tomorrow for them to get back.

1
  • Hi HariM - did you ever find a more satisfactory solution to this problem or are you still using the workaround you proposed in your answer? Mar 22, 2012 at 15:29

5 Answers 5

1

Upgrade to the latest version of Siteminder, remove all the ISAPI, move from ClassicMode to IntegratedMode as MVC / WEB API needed then use just CASiteMinderWebagentModule

and forget about the whole stupidity around hacking MVC/Webapi because ISAPi and siteminder, MVC/Webapi was never designed to run under ClassicMode.

0

You can do this from IIS Manager by editing the handler for Siteminder, clicking on Request Restrictions and make sure that the Mapping checkbox is unchecked.

Alternately, if you do this directly from applicationHost.config, set the resourceType to "Unspecified". This will cause the handler to process all requests, whether or not the file or folder exists.

5
  • Thanks you. I have done that. I dont see Reqeust Restrictions for "Wildcard Script Map". But the PathType is set to Unspecified. In this case seems like Asp.Net MVC is taking the request even before Siteminder processing the request and responding back to client. I see a Log for MVC request in IIS logs but not in Siteminder logs.
    – HariM
    Dec 16, 2010 at 19:49
  • It sounds like it's setup correctly to handle different extensions. You can reorder the handlers to have the process in the opposite order. They load from top to bottom. Dec 16, 2010 at 20:18
  • When I see the ordered list, Siteminder handler shows up first in the list.
    – HariM
    Dec 16, 2010 at 20:22
  • Also, to process MVC request we have added <modules runAllManagedModulesForAllRequests="true"/> to web.config file under system.webServer.
    – HariM
    Dec 16, 2010 at 20:31
  • It's possible that they need to load in the other order. You can also try Failed Request Tracing. That will show you exactly what loads, in which order and if there is a match for the path or not. Dec 16, 2010 at 21:05
0

Here is the explanation and workaround from Microsoft on ASP.Net MVC with Siteminder.

A request can be executed by any ONE handler, but can be worked upon by multiple modules. When a request comes in the URLRoutingModule routes the requests to the handler for MVC (if a map for it exists in the routing table as defined in the Application_Start event of the Global.asax), and the SiteMinder handler is never invoked. Since only one handler can execute the request and in this case it should be the MVC handler SiteMinder login page never comes up. One handler executing a request is a by design behavior.

Suggested Workaround:

i) In the AuthenticateRequest method in Global.asax check to see if the SSO session cookie is there in the request.

ii) If the cookie is not there, then redirect to another SSO login page.

iii) The login page responsible for authentication should not be in the MVC routing table.

iv) If a request for a page that is not in the MVC routing table comes in, the SiteMinder will come into action as the URLMappingsModule will not route this to the MVC handler as expected.

v) On this page, after authentication, the user can be redirected to the main URL that was requested earlier. As this time we have the SSO session cookie, so the request will not be redirected in the AuthenticateRequest and would be responded to by MVC.

We are following this work around. This must be implemented with caution as there is a chance that the Siteminder cookie could be invalidated but not checked by siteminder as the request wont go thru siteminder for MVC requests.

0

Our SiteMinder infrastructure team suggested that I try including the Web Agent's handler declaration in the web.config file, listed before the MVC handler like so:

<system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <modules runAllManagedModulesForAllRequests="true" />    
    <handlers>
        <add name="wa-handler" path="*" verb="*" type="" modules="IsapiModule" scriptProcessor="%NETE_WA_PATH%\ISAPI6WebAgent.dll" resourceType="Unspecified" requireAccess="None" allowPathInfo="false" preCondition="" responseBufferLimit="4194304" />
        <add name="MVC" path="*" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="None" preCondition="" />            
    </handlers>
</system.webServer>

That worked for us and did not require any special workarounds (e.g. using cookie/header detection and URL redirections) in Global.asax.

1
  • 1
    Doesn't work for me. Did you complete any additional configuration other than this?
    – Raj
    Feb 22, 2012 at 15:29
0

I had the same problem on my MVC-2 site even though the virtual folder was protected by siteminder.

Finally figured out what the issue was.

Changed the Application Pool mode to Classic from Integrated and voila! problem solved. Did not make any config change.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .