Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website running an ISAPI filter providing SSO functionality, as well as anonymous & basic authentication.

The ISAPI filter populates the "Authorization" header of each request with basic credentials e.g. basic base64EncodedString (username:password), which I can see using Fiddler.

Next I have an HTTP Module picking up the basic credentials from the "Authorization" header, decoding them and placing the username in a new header value. The new header is then picked up by Tridion and used by the inbuilt SSO module.

This solution works in IIS6, but not in IIS7.5; in IIS7.5 the "Authorization" header is not present in the request. I checked for the header both in the HTTP Module, and in a dummy ASPX page.

share|improve this question

Although IIS 7 supports ISAPI filters, Microsoft recommends that you extend Web server functionality by using modules instead of by using ISAPI filters.

Is there any reason why you have chosen to develop something on IIS 6 and now moving it to IIS 7.5?

Also have you followed the correct procedure of installing the ISAPI filter on IIS 7.5, as that differs from IIS 6. Perhaos you can share some more details on your ISAPI filter and it's configuration?

share|improve this answer
The ISAPI filter is provided by Oracle, it provides SSO functionality. The ISAPI filter was not the problem, it was working correctly. However, headers which it populated where being removed by IIS 7.5, I think due to increased security measures. We have since solved the issue by moving required values to none standard header keys. – Chris Morgan Nov 30 '12 at 19:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.