« Previous Next »

• 06-12-2009, 8:44 AM

  AMCGremlin Joined on 06-10-2009, 5:49 PM Posts 2

  LOGON_USER null after URL Rewrite Reply Contact I am trying to use IIS Integrated Authentication to authenticate users on server A before forwarding requests via URL Rewrite to a JBoss/Jetty application on server B. Although the users are forced to authenticate on server A, the request header received by Jetty contains a null value for LOGON_USER. Is this expected behavior or have I done something wrong? Thanks.

• 06-12-2009, 10:09 AM

  In reply to

  anilr Joined on 05-23-2006, 10:13 PM Redmond, WA Posts 2,343	Re: LOGON_USER null after URL Rewrite Reply Contact You did not specify what kind of authentication you are using, one of the IIS builtin ones or something custom, you probably need to not do authentication on server A so that the authentication information is sent as-is to server B. Anil Ruia Senior Software Design Engineer IIS Core Server

• 06-12-2009, 10:40 AM

  In reply to

  AMCGremlin Joined on 06-10-2009, 5:49 PM Posts 2

  Re: LOGON_USER null after URL Rewrite Reply Contact Thanks for the fast response. We use Windows Authentication. The user must authenticate in IIS on server A using a domain account. Once the user has authenticated, the request gets forwarded to the JBoss app on server B. JBoss uses the LOGON_USER value to identify the user. Since we synchronize via LDAP with AD and store the user names within our db, we simply match the LOGON_USER with the names locally held. Since authentication has been completed we do not require further authentication within the application. This provides us with a simple form of single sign-on. Today we use IIS6 and the mod_jk ISAPI filter for this. We would like to replace IIS6 and the ISAPI filter with IIS7 and ARR. In some cases server A and server B are different machines (e.g. server A is outside the firewall and server B is inside) so as to provide additional isolation between the application and the internet. In other cases (e.g. single sign-on is the primary requirement within a corporate intranet) IIS and mod_jk are located on the same server as JBoss. Given this situation, is there a way to configure IIS7/ARR so the LOGON_USER value contains the authenticated user name when the request is received on server B? Or is there a better way to configure things to achieve the same results we are seeking? Thanks again.

• 07-15-2009, 9:15 PM

  In reply to

  anilr Joined on 05-23-2006, 10:13 PM Redmond, WA Posts 2,343	Re: LOGON_USER null after URL Rewrite Reply Contact No, there is no secure way to do this without actually authenticating on the backend server - you could add the LOGON_USER to a request header which is picked up the backend application server but if the clients can directly hit the backend server, they can spoof it easily. Anil Ruia Senior Software Design Engineer IIS Core Server