Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the configuration... is reverse-proxied by URL Rewrite on IIS 7.5 to targetserver.ourdomain.local. The rules are set for one front-end site bound to port 80 with appropriate host header, not the whole web server. The front-end web server and the back-end target server are not on the same Windows domain. The service on 'targetserver' requires some form of authentication. Anonymous is not an option, but I would choose it if I could. I've set it to use basic authentication, and after a manual login everything works great.

Does anyone know how to configure IIS or URL Rewrite to access the target server with specific credentials so an http request to the front-end no longer requires the pass-through authentication?

I've tried creating a local account on both servers with the same username and password, authorizing it on the target server (works fine with direct test), and set it as both the application pool account and 'Connect as' account on the front-end site. Didn't work though.

Maybe that approach would work with Windows authentication instead of basic?

I also tried including the username and password within the URL like this: This does work with Firefox and Chrome, but not with IE.

Does anyone know how to configure URL Rewrite to authenticate with specific credentials?

I'm convinced there has to be a way to do this. Thank you in advance for your thoughts.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.