Installing the Shibboleth SP for IIS 6

V2.4+ are NOT compatible with Windows 2003 Server RTM (without SP1).

The installer does not work fully in conjunction with the IIS "Shared Configuration" option. Disable it prior to installation. After re-enabling it, you will likely have to manually apply some of the configuration changes noted below.


  1. Download the .msi Shibboleth SP installer from the Shibboleth download site.
  2. Run the installer. The installer will prompt for an install path, change default configuration files as appropriate for Windows, and set various environment variables for you. The shibd service will also be installed.

After rebooting, IIS should be configured for basic support (if you asked it to do so). If you have problems, need to manually configure it, or want to verify what happened, the IIS steps are as follows:

  1. Add the filter using the Internet Services Manager console. Right click on the "Web Sites" icon on the left, and bring up the Properties dialog. On the "ISAPI Filters" tab, add a new filter called Shibboleth and specify the lib\shibboleth\isapi_shib.dll library (orĀ lib64\shibboleth\isapi_shib.dll for a 64-bit IIS). The priority should be High. You won't see any visual indication it was loaded until after making requests to the server.
  2. Map the .sso file extension to the ISAPI library so that virtual URLs can be specified to invoke the extension handler for each web site. On the Home Directory tab, add a script mapping using the Configuration button. The Executable box should point to isapi_shib.dll, and the "Extension" can be set to anything unlikely to conflict, but .sso is assumed (and the dot must be included). You should NOT select the option to limit verbs, and you MUST uncheck the Check that file exists box.
  3. Add the Shibboleth ISAPI Extension to the list of permitted extensions in the list of allowed extensions.
  4. Restart IIS and make sure the filter shows up with a green arrow once you access the site. Check the Windows event log and/or the Shibboleth logs if it fails to load.

Basic Configuration