IIS/ARR reverse proxy negotiate pass-through

kab00m

10/24/23, 11:13 AM

I am having hard time with IIS/ARR reverse proxying to WildFly application server. On Linux we use web-servers to offload HTTPS, authentication and security functions from application server, so the initial idea was to do the same with IIS.

Application use WebSockets, it means Jakarta ISAPI redirector is of no help and we are using ARR instead.
ARR is not capable to forward authenticated user information, so we had to stop using Kerberos on IIS and now it is supported in WildFly with waffle module.
We are aware of HeliconTech products like ISAPI Rewrite but would like to use no additional price software.

It seems that IIS block or break negotiation between client and application server. Test servlet I placed in application server works good being accessed directly, but popup authentication window being accessed through IIS/ARR.

<rule name="ReverseProxyInboundRuleAT" enabled="true" stopProcessing="true">
    <match url="^(auth-test)(/.*|$)"/>                  
    <action type="Rewrite" url="http://127.0.0.1:8080/{R:0}" logRewrittenUrl="true" />  
    <serverVariables>
        <set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="" />                   
        <set name="HTTP_X-Forwarded-Proto" value="https" /> 
        <set name="HTTP_X-Forwarded-Port" value="443" />    
        <set name="HTTP_X-Forwarded-HOST" value="site.example.com" />                       
    </serverVariables>
</rule>

Authentication fails with waffle error:

error logging in user: com.sun.jna.platform.win32.Win32Exception: The token supplied to the function is invalid

It happens on Windows Server 2016/2019 and IIS 10. Is it possible to place Kerberos-protected SSO application behind IIS?

UPD: I have checked that Apache HTTP Server does not ruin negotiation protocol proxying requests to WildFly, but IIS does. Comparing to Apache proxy server IIS "eat" two packets in the middle of Negotiate conversation like initial proposal and reply for it.

611

1 + 2

iis

reverse-proxy

wildfly

Lex Li

10/24/23, 4:00 PM

To bridge IIS and Java web apps, you should use https://stackoverflow.com/tags/httpplatformhandler/info HttpPlatformHandler can pass Windows authentication token onto the web app behind, so you can decode user information (Python version can be found in https://stackoverflow.com/questions/62806295/how-to-get-the-authenticated-user-name-in-python-when-fronting-it-with-iis-http).

kab00m

10/25/23, 7:05 PM

Very good idea, thank you. However I am still searching for any information about decoding this token in Java.

Score:0

Server

kab00m

10/25/23, 7:34 PM

I found that IIS "eat" authentication packets if have this feature just installed. So if you want to have negotiation pass-through you can just uninstall it via Server Manager. Anyway the whole task is more complexed because it seems that NTLMSSP packets in Negotiate can be passed through IIS/ARR, but Kerberos may not. As stated here it breaks on IIS as on extra hop.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: IIS/ARR reverse proxy negotiate pass-through

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.