...
Default matches the status of the useHeaders flag. Causes all non-alphanumeric characters to be removed from the names of all SP-controlled headers, as their presence makes header smuggling much harder to guard against due to IIS implementation choices (bad ones, that is).
handlerPrefix = /Shibboleth.sso
Optimizes ignoring non-handler requests when a default or static handlerURL is used, as is generally the case.
[<site-id>]
Every other section in the file represents a Site in IIS, with the Site ID used as the section key. The equivalent of Apache’s ServerName command to virtualize the settings for a site, but with each component separated into a discrete property to avoid the need to parse a URL.
...