Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to add Active Directory single-sign-on support to an existing SOAP server. The server can be configured to accept a trusted reverse-proxy and use the X-Remote-User HTTP header for the authenticated user. I want to configure IIS to be the trusted proxy for this service, so that it handles all of the Active Directory authentication for the SOAP server.

Basically IIS would have to accept HTTP connections on port X and URL Y, do all the authentication, and then proxy the connection to a different server (most likely the same X and Y).

Unfortunately, I have no knowledge of IIS or AD (so I am trying my best to learn enough to build this solution) so please be gentle. I would assume that this is not an uncommon scenario, so is there some easy way to do this?

  1. Is this sort of functionality built into IIS or do I need to build some sort of IIS proxy program myself?

  2. Is there a better option for getting the authentication done and the X-Remote-User HTTP header set than requiring IIS?

Update:

For example, what I am trying to create is:

  [CLIENT]            [IIS]         [AD]        [SOAP-SERVER]
1.    |---------------->| 
2.    |<--------------->|<---------->| 
3.                      |--------------------------->| 
4.                      |<---------------------------| 
5.    |<----------------| 

1. POST to http://example.com/foo/bar.cgi
2. Client is not authenticated, so do authentication
3. Once validated, send request to server (X-Remote-User: {userid})
4. Process request, send response
5. Forward response to client

I need to know how to configure IIS to do the automatic authentication of the user using AD, and then to proxy the request to the actual server, sending the userid in the X-Remote-User HTTP header.

share|improve this question
    
I'll add a followup for this problem: because the customer was running PHP on IIS (to run our app), it was easier to just write a simple PHP proxy. This has turned into our standard solution for the IIS as a reverse proxy (for our service). –  brofield Nov 30 '11 at 11:33
add comment

3 Answers

up vote 1 down vote accepted
+100

The simplest solution to this is to use ISA server (or Forefront TMG) as a reverse proxy for the website. You can configure the ISA rule for the website to authenticate user access via AD.

You can also manipulate host headers from the site, and should be able to achieve what you want via the HTTP policy options for the website's rule.

I don't believe the functionality you require is available in IIS.

share|improve this answer
    
Thanks for the reply Chris. The ISA server may provide a good solution, however I can't imagine my customers wanting to pony up the cash for it. From what I read (although a lot of the terminology escapes me), it appears that Apache can do something like this via ntlm and proxy modules. IIS doesn't have something similar? –  brofield May 13 '10 at 9:39
    
My IIS knowledge isn't strong enough to answer authoritatively on that score. Server-Side Forwarding is possible in IIS but I'm not sure it'll provide the authentication you're after as part of the deal. Hopefully someone with more IIS experience will weigh in shortly :) –  Chris Thorpe May 13 '10 at 10:34
add comment

I'd recommend taking a look at running Active Directory Federation Services. It can provide single-signon.

http://msdn.microsoft.com/en-us/magazine/cc163520.aspx

share|improve this answer
add comment

Just like Apache can do similar things with modules, so can IIS - however, nothing is baked into it natively that allows for reverse proxy behavior.

You can get some reverse proxy like behavior through URL rewriting and the Application Request Routing modules. I don't know if you can get it to go so far as modifying the headers. See this blog post for more info: http://blogs.iis.net/wonyoo/archive/2008/07/09/application-request-routing-arr-as-a-reverse-proxy.aspx

You can also deploy custom code that functions similarly. See this article for a sample implementation, although your results might not be quite what you expect - it is actually a harder problem than just simply shifting bits across the wire through a middle man: http://www.codeproject.com/KB/web-security/HTTPReverseProxy.aspx

Really for reverse proxying you should be looking at ISA server for sticking with the MS platform.

share|improve this answer
    
Thanks Goyuix for your comments. I have played with iisproxy.net but due to zero knowledge of IIS I was getting lost in configuration. I'll recommend the ISA server, and hopefully if they don't want to use it then they will find their own solution. –  brofield May 18 '10 at 5:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.