WebAPI 2 (OWIN/Katana/IIS 7.5) routing broken when protected by CA SiteMinder

Question

I've got a WebAPI 2 app built on top of the OWIN/Katana stack, hosted in IIS 7.5, and I can't seem to get the WebAPI routing to work when SiteMinder tries to redirect to my API route (it returns a 404).

Siteminder is correctly installed on this web server (works fine with my MVC 5 app, which is in a sibling IIS application to my OWIN WebAPI app).

When the SiteMinder IIS7WebAgent module is removed from my WebAPI app, all is fine, and my routes are properly recognized.

However, when I add the web agent module (with runAllManagedModulesForAllRequests="true"), only requests to the WebAPI's default route work (i.e., "/myapp/" routes to my default "home" controller, but requests to "/myapp/home" all return 404).

Does anyone have any idea of how this needs to be configured?

Answer 1

It looks like this was caused by a bug in SiteMinder's integration with the IIS integrated pipeline.

Our issue went away after updating CA SiteMinder to r12.51.