IIS - ARR to perform authentication

1
votes

Is it possible to achieve the below mentioned scenario with IIS - ARR combination? or with any additional development.

Have a front end web server (reverse proxy kind of), in DMZ, which will authenticate (and if possible authorize) users and then forwards the request to corresponding application servers with in the internal network.

Any suggestions / thoughts would be really helpful.

2
iisarr
How do you plan on passing authentication from your "DMZ" to an internal network if they aren't aware of each other? The only way I know to do this is to use Windows Authentication - all computers part of the same domain - which negates your DMZ requirement. - Brock Hensley
Even I can use Http Headers for that (if custom code development is an option). internal network systems can trust HTTP Headers from the DMZ server. Windows authentication might be an overhead, since delegation might need to be enabled). Whole point is to authenticate users in DMZ, pass on the authenticated user info to internal network, which internal systems will trust. Will this be an option? - user1206686
Am trying to draw parallels with the IBM webseal product here, which does similar stuff. Trying to see if we can achieve a similar thing using MS stack. - user1206686

2 Answers

0
votes

The short answer is "no", as it isn't a feature out of the box.

The longer answer is "yes" because you can write a native module for IIS that does whatever you want before ARR gets its hands on the request (modify headers, change the target host, modify the request body, etc).

I know this works as I used this method to implement some common middleware (authentication, cors, common error pages, cookie rewriting) across a set of services using a variety of technologies.

This is the starting point for the documentation:

"Walkthrough: Creating a Request-Level HTTP Module By Using Native Code"

https://msdn.microsoft.com/en-us/library/ms689320(v=vs.90).aspx

-1
votes

You could achieve this by adding in a Query String value equivalent to "?authorized=false/true", Use ARR to evalute the Query String Value - if authorized=false route to authorization server farm, then send the same URL from the authorization process with query string authorized=true which will route to the "live" server farm.

Of course you will probably want to use some other value than "authorized" in plain text in your URL!

You could possibly do the same thing in the header, using appcmd you can manipulate headers in ARR. The schema for ARR is in the C:\Windows\system32\inetsrv\config\schema\arr_schema.xml file. If you examine this schema you will see where the Header elements are.

HTH