Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Shibboleth SP instance on Server 2008 R2 and everything is authenticating fine with the IdP.

I was testing protecting a single page and that is working fine by doing the following in the shibboleth2.xml file:

<Host name="">
     <Path name="page.jsp" authType="shibboleth" requireSession="true"/>

When I go to I get redirected to enter credentials, and then end up back on the page.jsp

Now I found out that I should be protecting the Document Root, but not the entire site.
Basically I need to be authenticated by Shibboleth, and once I am, then I'll get redirected back to the Document Root where a session is set with separate software, I get redirected to a different page and the Document Root will never be used again.

Any help is appreciated

share|improve this question

I do not see an easy way to this with IIS. However...

My recommendation is that you check for the values (the HTTP headers when using IIS) Shibboleth supplies. If they are there all fine. If not you redirect to your login url like <---- this is protected by shibboleth

On this url you can set up your application session and if everything is fine you can redirect back to the main page.

share|improve this answer
I do have a similar workaround in place. I was just hoping that there was a more elegant solution that would allow for a more standard install. – OrangeGrover Sep 29 '12 at 18:40
I would not say this is a workaround. Moodle (on apache) use the same method. – cstamas Sep 29 '12 at 19:00

How about this?

<Host name="">
     <PathRegex regex=".*" authType="shibboleth" requireSession="true" />

Essentially, a regex to protect the entire root.

Edit #1 - Just saw how old this was... yikes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.