带有IIS的simpleSAMLphp和不同的应用程序池标识

Question

I've been struggling since a day now with simpleSAMLphp in IIS and I just managed to understand why.

So I have simpleSAMLphp running as IUSR in a separated application https://myserver/simpleSAMLphp. This (used only as SP) is configured with my AD FS environment (single IdP).

I then created a test simpleTest application which also runs as IUSR. Everything worked ok.

I finally added my real DEV application, which runs as mydomain\myserviceaccount and here I experience multiple redirects until I get some errors in simplesamlphp. After some troubleshooting, I realized that when I change my web app to use IUSR, it works as expected. Unfortunately, I can't keep my app to run as IUSR and I don't even want to change simpleSAMLphp to use the service account as in theory I may end up having multiple service accounts for each pool anyway.

Did anybody experience the same and has a workaround to allow another account to be able to work with the token provided by simpleSAMLphp?

My ultimate goal is to use a single instance of simpleSAMLphp and add all of my apps to use AD FS to login, so multiple SPs with 1 IdP.

This is the bit of code I'm using on the PHP pages to see if the user is already authenticated:

require_once ('C:\inetpub\wwwroot\simplesamlphp\lib\_autoload.php');
$as = new SimpleSAML_Auth_Simple('default-sp');
if (!$as->isAuthenticated()) {
  $params = array(
    'ErrorURL' => '/MyApp/error.php',
  );
  $as->login($params);

}

Many thanks

Answer 1

I figured this out eventually, I hope this helps anybody using the same config as mine.

So the issue was related to PERMISSIONS, for a change. What drove me off track was the fact that another SP was working fine, until I realized, that SP was also using IUSR.

So if you want to use multiple SPs for multiple web apps running with different service accounts, the best is to run simpleSAMLphp's pool as a user who has local admin rights. Even running with SYSTEM worked during my testing, but I guess it's best to just get a new account set up for it.

I've made various tests to confirm the above.

Edit This is what I've done basically: https://www.itdroplets.com/simplesamlphp-on-iis-from-scratch-adfs/