Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a way to tell IIS 6 that even though a request came by http, it can be considered as https.

The HTTPS is managed before the request arrive on applications server. With Tomcat, we use the RemoteIpValve with the http header X-Forwarded-Proto to tell Tomcat if the connection is secure, or not.

Is there a way to do it in IIS? Could an Isapi Filter be a solution?

Thank you for all hints.

[EDIT :] To be more precise : The architecture is as follow, for our tomcat :

    USER
      |
     LoadBalancer (KeepAlived)
     |  |
     |  '- Apache (SSL)
     |
     HaProxy
     |
     |
     Tomcat

When a user makes an https Request on the tomcat, the request passes through the apache where the https is decoded(Apache adds the X-Forwarded-Proto: https header). Then the request is redirected toward Tomcat through HaProxy(Http LoadBalancer).

I hope it is a little more clear.

PS: Please excuse my english, I don't practice it enough.

share|improve this question
    
What's the device sitting between the user and the web server? If it's a BigIP, you could use a stream profile and irule to rewrite the responses back to the client as https. –  mahnsc Mar 28 '11 at 13:06
    
I edited my question with precision on the architecture. We have no problem establishing the https connection with the client. We just want IIS to know that the connection is secure even though it receives http. @mahnsc Did i understand your comment wrong? –  CédricC Mar 28 '11 at 14:02
    
I do not see IIS in your diagram. –  Mircea Vutcovici Mar 28 '11 at 14:06
    
@Mircea Vutcovici : If i get it to work, IIS would be where Tomcat is :) –  CédricC Mar 28 '11 at 14:12

1 Answer 1

up vote 3 down vote accepted

As an example, for IIS7, Application Request Routing (ARR) + ARR Helper does this by adding x-headers like you're doing with Tomcat.

You would need an ISAPI Filter to rewrite the x-header back to the original header values on the IIS6 box. Microsoft doesn't have an IIS6 solution for rewriting the header, but you could see if the BigIP client will do it for you, or else write your own.

IIS7 has native solutions already so if you need to choose between developing your own ISAPI Filter (not an easy task) or upgrading, this may be an opportunity to consider upgrading your environment.

share|improve this answer
    
I was afraid of that :) I did find a module for IIS 7. I was just hoping for a solution with IIS6. Thanks for the answer. –  CédricC Mar 28 '11 at 14:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.