simpleSAMLphp on IIS6 using FastCGI

[belfilie]

Hi all,

I'm trying to get simplesamlphp running on IIS6 using FastCGI and I'm
having some config issues, I was hoping someone in the mailing list
might help!

I followed this documentation to install simplesamlphp ->
http://simplesamlphp.org/docs/1.8/simplesamlphp-install
however that document is specific to Apache.
I looked for documentation specific to IIS and found these other two
documents:
1) http://wayf.dk/wayfweb/howto%27s_attchmt/SimplesamlPHP%20on%20windows%202003%20server%20minimal%20installguide.pdf
2) http://www.edugate.ie/workshop-guides/simplesamlphp-14-identity-provider-installation-windows-iis-6

I followed the steps as closely as possible but my issue is that both
documents use PHP 5.2.x with ISAPI while I'm using PHP 5.3.2 using
FastCGI (using non-thread safe for speed). It's not an option for me
to downgrade to PHP 5.2.x and I have to continue using FastCGI. Also I
read that Microsoft doesn't support anymore ISAPI since FastCGI GA in
2009.

I'm at a point where I can get to http://<mywebserver>/simplesaml/index.php
and I get redirected to
http://<mywebserver>/simplesaml/module.php/core/frontpage_welcome.php
At that point I'm getting a 404 Object Not Found error

I saw from googling that "/simplesaml/module.php/core/
frontpage_welcome.php" is a valid URL - just wondering how to go past
this point.
PHP can execute correctly in my virtual share, I can successfully echo
something out on index.php before I get redirected to
frontpage_welcome.php but at that point I get a 404
I suspect I might be missing something in config.php but not sure
what.. the basepath parameter points to simplesaml/ and I'm not sure
what else I should be changing there...

Any help is very much appreciated!

Thanks in advance,

Ileana

[Olav Morken]

My guess is that there is an issue with PATH_INFO (which allows us to
determine which page module.php actually refers to). A quick google
search for �fastcgi iis path_info� shows that cgi.fix_pathinfo must be
enabled under IIS:

http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo

Regards,
Olav Morken
UNINETT / Feide

[belfilie]

Hi Olav,

thank you for your reply.
I checked php.ini and cgi.fix_pathinfo is currently enabled (set to 1)

Any idea of what else could be missing?
Thanks again,

Ileana

On Jun 6, 6:56 am, Olav Morken <olav.mor...@uninett.no> wrote:
> On Thu, Jun 02, 2011 at 09:07:48 -0700, belfilie wrote:
> > Hi all,
>
> > I'm trying to get simplesamlphp running on IIS6 using FastCGI and I'm
> > having some config issues, I was hoping someone in the mailing list
> > might help!
>
> > I followed this documentation to install simplesamlphp ->
> >http://simplesamlphp.org/docs/1.8/simplesamlphp-install
> >  however that document is specific to Apache.

> > I looked for documentation specific toIISand found these other two
> > documents:
> > 1)  http://wayf.dk/wayfweb/howto%27s_attchmt/SimplesamlPHP%20on%20windows...
> > 2)  http://www.edugate.ie/workshop-guides/simplesamlphp-14-identity-provi...

>
> > I followed the steps as closely as possible but my issue is that both
> > documents use PHP 5.2.x with ISAPI while I'm using PHP 5.3.2 using
> > FastCGI (using non-thread safe for speed). It's not an option for me
> > to downgrade to PHP 5.2.x and I have to continue using FastCGI. Also I
> > read that Microsoft doesn't support anymore ISAPI since FastCGI GA in
> > 2009.
>
> > I'm at a point where I can get to http://<mywebserver>/simplesaml/index.php
> > and I get redirected to
> > http://<mywebserver>/simplesaml/module.php/core/frontpage_welcome.php
> > At that point I'm getting a 404 Object Not Found error
>
> > I saw from googling that "/simplesaml/module.php/core/
> > frontpage_welcome.php" is a valid URL - just wondering how to go past
> > this point.
> > PHP can execute correctly in my virtual share, I can successfully echo
> > something out on index.php before I get redirected to
> > frontpage_welcome.php but at that point I get a 404
> > I suspect I might be missing something in config.php but not sure
> > what.. the basepath parameter points to simplesaml/ and I'm not sure
> > what else I should be changing there...
>
> My guess is that there is an issue with PATH_INFO (which allows us to
> determine which page module.php actually refers to). A quick google

> search for fastcgiiispath_info shows that cgi.fix_pathinfo must be

> enabled underIIS:
>
>    http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
>
> Regards,
> Olav Morken

> UNINETT / Feide- Hide quoted text -
>
> - Show quoted text -

[Peter Schober]

* belfilie <ileanab...@gmail.com> [2011-06-07 11:32]:

> I checked php.ini and cgi.fix_pathinfo is currently enabled (set to 1)
>
> Any idea of what else could be missing?

I would say how to get PHP's pathinfo to work on M$-IIS via FastCGI is
more a question for some microsoft or IIS support forum.
-peter

[belfilie]

Hi Peter,

thanks for your reply.
I have been using PHP and FastCGI in my environment for a number of
years now and with no issue, my issue is only with SimpleSAMLphp
getting to the correct module. I have a requirement to introduce
authentication leveraging the SAML authentication protocol, so I
thought I could use the SimpleSAMLphp library instead of writing my
own implementation of the protocol. As before, my environment has been
working with IIS and FastCGI for a number of years now.

Again, I would be grateful if anybody had any suggestion on what else
could be wrong.

Many Thanks,

Ileana


On Jun 7, 10:54 am, Peter Schober <peter.scho...@univie.ac.at> wrote:
> * belfilie <ileanabelfi...@gmail.com> [2011-06-07 11:32]:

[Peter Schober]

* belfilie <ileanab...@gmail.com> [2011-06-07 12:17]:

> I have been using PHP and FastCGI in my environment for a number of
> years now and with no issue, my issue is only with SimpleSAMLphp
> getting to the correct module.

Then it seems you have not been relying on PHP's pathinfo feature.
SimpleSAMLphp is making use of that, but that does not make your
pathinfo problem a SimpleSAMLphp problem. It is still a PHP problem in
your specific environment.
Fyi, we use SimpleSAMLphp with FastCGI and Apache httpd without
any problems. If your webserver (configuration) is the problem (I'm
not saying it is; I have no experience with M$-IIS whatsoever) either
change the software or get support from the vendor.

> I have a requirement to introduce authentication leveraging the SAML
> authentication protocol, so I thought I could use the SimpleSAMLphp
> library instead of writing my own implementation of the protocol.

If you really think getting PHP to work properly (including pathinfo)
in your deployment is more work (or even a comparable amount of work)
than writing a interoperable SAML Service Provider or Identity
Provider please go ahead and try.
-peter

[belfilie]

This page explains how to fix the path_info problem with IIS for PHP
applications -> http://911-need-code-help.blogspot.com/2011/02/url-rewriting-on-iis-using-pathinfo.html