Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

for testing purpose, i've setup a nginx reverse proxy for an IIS6 server, this works OK.

But when i try to use "windows authentication" on the IIS6 web site, the browser auth input doesn't get's there.

After some reading, i found the obvious :) nginx doesn't support HTTP/1.1 for reverse proxy yet!

My question: Does anyone knows a "workaround" for this type of request?

Thanks

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

I've partially got this working in a test environment here.

Background

We have IIS6 serving our intranet CMS (the CMS is an ISAPI plugin). This is with the site setup in IIS for integrated windows authentication (for both security & user personalisation).

I want to get gzip compression enabled but due to some of the features we have switched on in our CMS we can't do this via IIS's gzip settings (it crashes upon every request to the CMS if we do).

So, I'm currently testing a setup with an nginx reverse proxy infront of IIS doing the content gzipping.

What works/what doesn't?

IE6/7 auth via this setup still works fine, I didn't have to make any changes.

Firefox however needed a change. Before, without nginx, Firefox had network.automatic-ntlm-auth.trusted-uris set to allow our intranet server to do transparent NTLM auth. Once nginx was part of the mix you'd just get repeatedly shown the site login box and your credentials would never be accepted. However, adding the intranet server to network.negotiate-auth.trusted-uris fixed this (for Firefox on Windows but not on OS X). It seems the authentication method may have changed slightly? Where allowing NTLM auth before worked fine it now seems to be doing SPENGO?

So the current situation with nginx in front of IIS6 has left me with:

Works

  • IE6 on XP
  • IE7 on XP
  • FF3.5 on XP (after changing about:config)

Doesn't work (credentials never accepted)

  • FF3.5 on OS X
  • Safari 3 on OS X
  • Safari 4 on XP
  • Blackberry 8700 (Simulator)
  • Blackberry 9000 (Simulator)

At a guess as to why mine (partially) works and yours doesn't... Possibly something crucial to proxying the auth handshake that's in my config but missing from yours? Such as forwarding the real client IP? The relevant server section of my nginx config is below if you want to give it a try.

server {
    listen 80;
    server_name testintralive;

    location / {
        proxy_pass http://localhost:81;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_max_temp_file_size 0;
        proxy_connect_timeout 30;
        proxy_read_timeout 120;
    }
}
share|improve this answer
add comment

The only way I could get it to work was to use basic auth and wait for igor to finish the next release. The next version is slated to fix this (hopefully)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.