I have a website running an ISAPI filter providing SSO functionality, as well as anonymous & basic authentication.

The ISAPI filter populates the "Authorization" header of each request with basic credentials e.g. basic base64EncodedString (username:password), which I can see using Fiddler.

Next I have an HTTP Module picking up the basic credentials from the "Authorization" header, decoding them and placing the username in a new header value. The new header is then picked up by Tridion and used by the inbuilt SSO module.

This solution works in IIS6, but not in IIS7.5; in IIS7.5 the "Authorization" header is not present in the request. I checked for the header both in the HTTP Module, and in a dummy ASPX page.

1 Answer 1


Although IIS 7 supports ISAPI filters, Microsoft recommends that you extend Web server functionality by using modules instead of by using ISAPI filters.

Is there any reason why you have chosen to develop something on IIS 6 and now moving it to IIS 7.5?

Also have you followed the correct procedure of installing the ISAPI filter on IIS 7.5, as that differs from IIS 6. Perhaos you can share some more details on your ISAPI filter and it's configuration?

  • The ISAPI filter is provided by Oracle, it provides SSO functionality. The ISAPI filter was not the problem, it was working correctly. However, headers which it populated where being removed by IIS 7.5, I think due to increased security measures. We have since solved the issue by moving required values to none standard header keys. Nov 30, 2012 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.