Re: ISAPI extensions and performance problems with NTLM authentication

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 01/19/05

  • Next message: David Wang [Msft]: "Re: IIS6 + ISAPI Filter + Application Pool Identity problem" 
    Date: Tue, 18 Jan 2005 21:47:30 -0800

    1. No, your issue has nothing to do with ISAPI Extensions. IIS keeps NTLM
    authentication alive whenever possible, regardless of the server-side code
    (remember, IIS controls the connection status and NTLM negotiation and ISAPI
    Extension have NO ability to affect/interact in the negotiation)

    Now, it could be possible that your server side ISAPI code is intentionally
    causing the connection to close and hence induceing this issue. That would
    be a debug in your ISAPI extension that you need to debug using a network
    sniffer like NetMon.

    2. Kerberos is a completely different authentication protocol from NTLM, so
    you cannot say that by switching protocols the "performance problems" go
    away.

    NTLM is connection based authentication, and re-authenticating is currently
    hurting your performance. While switching to Kerberos authentication
    removes the connection-based limitation, it introduces other ones -- such as
    traffic/bottleneck at the KDC, increased request size due to the Kerberos
    ticket, increased traffic from all services to the KDC to verify your
    Kerberos ticket, etc. You will have to determine which tradeoffs make sense
    in your design and then test it out to determine if the problem really goes
    away. 

    -- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Graham" <gneumann69@yahoo.com> wrote in message
news:1105986613.902465.203890@z14g2000cwz.googlegroups.com...
I have developed an ISAPI extension that acts as a proxy for content
hosted by a a backend server. The idea is that the proxy (and IIS 6.0)
will handle authentication and then forward user identification to the
backend server. The proxy works fine when authentication is on. It also
works when Windows Integrated authentication is on, however performance
is impacted because connections between IE and IIS seem to be short
lived, which means that NTLM handshakes happen for pretty much every
request.
I came accross the following article which seems to be related:
http://groups-beta.google.com/group/microsoft.public.dotnet.framework.aspnet.webservices/browse_thread/thread/a1720d5b16e625e1/bf2e4c07df171029?q=NTLM+IIS+performance&_done=%2Fgroups%3Fq%3DNTLM+IIS+performance%26&_doneTitle=Back+to+Search&&d#bf2e4c07df171029
It indicates that in ASP.NET, one needs to set a property called
UnsafeAuthenticatedConnectionSharing to TRUE in order for connections
to persist.
Two questions:
1) Is there a similar problem/solution for ISAPI extensions?
2) If Kerberos authentication is used, does the problem go away?
  • Next message: David Wang [Msft]: "Re: IIS6 + ISAPI Filter + Application Pool Identity problem"

    Relevant Pages

    • Re: Integrated Windows Authentication Timeout?
      ... Do you see anything different for the NTLM requests? ... You might consider enabling protocol transition authentication since you are ... Joe Kaplan-MS MVP Directory Services Programming ... server. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Integrated Windows Authentication Timeout?
      ... Is it possible that a different host name is being used for one of the subsequent requests that would break Kerberos auth? ... If you have "Negotiate" authentication set in the metabase, then this can still negotiate down to NTLM if for some reason the protocol thinks that Kerberos is unavailable. ... server. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Is NTLM Authentication very expensive? (for bandwidth)
      ... When Internet Explorer has established a connection with the server by ... especially not when you use NTLM authentication. ... NTLM uses a permanant channel. ... > server sends 3827 bytes to the client. ...
      (microsoft.public.inetserver.iis.security)
    • SSPI/NTLM between native code and managed code fails for Windows 2
      ... I have an appliction that uses C++/CLI code for the client side of an NTLM ... The server and client code run on different machines and use TCP/IP to throw ... the "token" back and forth until authentication occurs. ...
      (microsoft.public.platformsdk.security)
    • Re: Error: HTTP/1.1 407 Proxy Authentication Required
      ... It appears that the tool supports server auth, ... Scan through their FAQ and see what they say about proxy authentication. ... It has some built in http tests that supports NTLM ...
      (microsoft.public.isa)