I have two managed modules (Windows Identity Foundation FAM/SAM) integrated with a third party .NET 3.51 app under IIS 7.5 / Win2k8.
The FAM redirects unauthenticated users to a custom signin page. Upon successful authentication, SignIn will post back to the app where the FAM will validate the SAML token then perform HTTP get on the original page before redirection took place.
This all works well so long as as I enable runAllManagedModulesForAllRequests on the FAM/SAM modules element in web.config.
<modules runAllManagedModulesForAllRequests="true">
<add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
<add name="FederatedAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
</modules>
If I leave RAMMFAR set to false, the browser experiences an HTTP 405, Method not allowed (POST) error when the SAML token post back happens. With RAMMFAR disabled and failed request tracing enabled, you see the following trace records:
<failedRequest url="http://myserver.foo.com:80/Capture30/"
siteId="1"
appPoolId="AppPool1"
processId="420"
verb="POST"
remoteUserName=""
userName=""
tokenUserName="NT AUTHORITY\IUSR"
authenticationType="anonymous"
activityId="{00000000-0000-0000-1B00-0080000000EE}"
failureReason="STATUS_CODE"
statusCode="200"
triggerStatusCode="405"
timeTaken="110"
xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
>
.
.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>45</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2013-05-09T15:29:11.968Z"/>
<Correlation ActivityID="{00000000-0000-0000-1B00-0080000000EE}"/>
<Execution ProcessID="420" ThreadID="3100"/>
<Computer>MyServer</Computer>
</System>
<EventData>
<Data Name="ContextId">{00000000-0000-0000-1B00-0080000000EE}</Data>
<Data Name="Name">FederatedAuthenticationModule</Data>
<Data Name="Precondition">managedHandler</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>MODULE_PRECONDITION_NOT_MATCH</Opcode>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{D42CF7EF-DE92-473E-8B6C-621EA663113A}</EventGuid>
</ExtendedTracingInfo>
</Event>
.
.
.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>3</Level>
<Opcode>16</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2013-05-09T15:29:12.031Z"/>
<Correlation ActivityID="{00000000-0000-0000-1B00-0080000000EE}"/>
<Execution ProcessID="420" ThreadID="3100"/>
<Computer>MyServer</Computer>
</System>
<EventData>
<Data Name="ContextId">{00000000-0000-0000-1B00-0080000000EE}</Data>
<Data Name="ModuleName">StaticFileModule</Data>
<Data Name="Notification">128</Data>
<Data Name="HttpStatus">405</Data>
<Data Name="HttpReason">Method Not Allowed</Data>
<Data Name="HttpSubStatus">0</Data>
<Data Name="ErrorCode">2147942401</Data>
<Data Name="ConfigExceptionInfo"></Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>MODULE_SET_RESPONSE_ERROR_STATUS</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">EXECUTE_REQUEST_HANDLER</freb:Description>
<freb:Description Data="ErrorCode">Incorrect function.
(0x80070001)</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
From the log records, it appears that the POST of the SAML token is being handled by the StaticFileModule which results in HTTP 405 error. Once I enable RAMMFAR for the modules in web.config, the SAML token post works without error. I have read in multiple places that enabling RAMMFAR should be avoided as it comes with a significant performance penality. I have used the same FAM/SAM modules in other IIS 7.5/.NET 3.51 web apps where RAMMFAR did not have to be enabled. Is there some configuration in IIS that I can make so that I don't have to enable RAMMFAR for sucessful SAML token post?