Can I use IIS to do ActiveDirectory single-sign-on for another website?

Question

I'm trying to add Active Directory single-sign-on support to an existing SOAP server. The server can be configured to accept a trusted reverse-proxy and use the X-Remote-User HTTP header for the authenticated user. I want to configure IIS to be the trusted proxy for this service, so that it handles all of the Active Directory authentication for the SOAP server.

Basically IIS would have to accept HTTP connections on port X and URL Y, do all the authentication, and then proxy the connection to a different server (most likely the same X and Y).

Unfortunately, I have no knowledge of IIS or AD (so I am trying my best to learn enough to build this solution) so please be gentle. I would assume that this is not an uncommon scenario, so is there some easy way to do this?

1. Is this sort of functionality built into IIS or do I need to build some sort of IIS proxy program myself?

2. Is there a better option for getting the authentication done and the X-Remote-User HTTP header set than requiring IIS?

Update:

For example, what I am trying to create is:

  [CLIENT]            [IIS]         [AD]        [SOAP-SERVER]
1.    |---------------->| 
2.    |<--------------->|<---------->| 
3.                      |--------------------------->| 
4.                      |<---------------------------| 
5.    |<----------------| 

1. POST to http://example.com/foo/bar.cgi
2. Client is not authenticated, so do authentication
3. Once validated, send request to server (X-Remote-User: {userid})
4. Process request, send response
5. Forward response to client

I need to know how to configure IIS to do the automatic authentication of the user using AD, and then to proxy the request to the actual server, sending the userid in the X-Remote-User HTTP header.

Answer 1

The simplest solution to this is to use ISA server (or Forefront TMG) as a reverse proxy for the website. You can configure the ISA rule for the website to authenticate user access via AD.

You can also manipulate host headers from the site, and should be able to achieve what you want via the HTTP policy options for the website's rule.

I don't believe the functionality you require is available in IIS.

Answer 2

I'd recommend taking a look at running Active Directory Federation Services. It can provide single-signon.

http://msdn.microsoft.com/en-us/magazine/cc163520.aspx

Answer 3

Just like Apache can do similar things with modules, so can IIS - however, nothing is baked into it natively that allows for reverse proxy behavior.

You can get some reverse proxy like behavior through URL rewriting and the Application Request Routing modules. I don't know if you can get it to go so far as modifying the headers. See this blog post for more info: http://blogs.iis.net/wonyoo/archive/2008/07/09/application-request-routing-arr-as-a-reverse-proxy.aspx

You can also deploy custom code that functions similarly. See this article for a sample implementation, although your results might not be quite what you expect - it is actually a harder problem than just simply shifting bits across the wire through a middle man: http://www.codeproject.com/KB/web-security/HTTPReverseProxy.aspx

Really for reverse proxying you should be looking at ISA server for sticking with the MS platform.