Requests would be processes and resources protected, but login pages would return a 503 on IIS.
All framework based agents (12.0 - 12.52 SP2) on IIS.
The Default Application Pool in IIS was disabled. This caused all the Siteminder resources to not be accessible as the app pool the files are being served from was disabled. The agent plugin worked because that is run at the server level, the files the agent is supposed to reference are served out of the default application pool.
Re-enabling the Default Application Pool in IIS and Siteminder resource pages and login forms were able to be served.