Re: How does IIS handle user impersonation token?

From: Gery D. Dorazio (gdorazio_at_enque.net)
Date: 10/11/05 

Date: Tue, 11 Oct 2005 13:56:46 -0400

Thanks Ken...this helps a great deal.

I also took your advice from the post on the aspnet.security newsgroup and
installed fiddler. I ran it on both an online SharePoint machine and my
development SharePoint server and can see the NTLM sequencing that you
describe here. It's quite interesting how this works and it makes sense when
I close the browser after being logged onto SharePoint....I have to logon
again. Also, I can see the browser respond to 401s for every visit to the
site (for authorization required pages)...showing the 'automatic' NTLM
authorization sequence for each request.

Thanks for your help in this matter.

Gery 

-- 
Gery D. Dorazio
Development Engineer
EnQue Corporation
www.EnQue.com
www.ImagingHardware.com
"Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message 
news:uMaSspgzFHA.2424@TK2MSFTNGP12.phx.gbl...
> "Gery D. Dorazio" <gdorazio@enque.net> wrote in message
> news:egkTIhgzFHA.3892@TK2MSFTNGP12.phx.gbl...
> :I am using a custom authentication ISAPI filter/extension in conjunction
> : with using an html form page to authenticate users. As part of this
> process
> : I am trying to understand how IIS handles authentication on subsequent
> round
> : trips to the server. Specifically, how does IIS handle the user
> : impersonation token? Does it put it into a header or cookie for each
> request
> : after login?
>
> IIS doesn't put the user token anywhere (headers or cookie it sends to the
> client).
>
> If you are using something like Forms Authentication (with ASP.NET), then
> "yes", cookies are used, but that's a function of ASP.NET not IIS. 
> LIkewise,
> Password authentication uses cookies too, but that's part of the Passport
> infrastructure.
>
> For HTTP based authentication mechanisms (Basic, Digest, NTLM, Kerberos),
> the client sends the credentials to IIS using the Authorization: header as
> part of each request to the server. The server does not send any
> authentication information to the client (all the server does is challenge
> the client if the client attempts to make an anonymous request, and as 
> part
> of the challenge lists the acceptable authentication mechanisms via the 
> use
> of WWW-Authenticate: headers).
>
> Hope that helps.
>
> Cheers
> Ken
>
>
>
>
>
> :
> : I am trying to understand this so that I can properly initialize the
> : impersonation token into the right place so that IIS can continue doing
> its
> : authentication.
> :
> : Any helpful good reads on this would be appreciated.
> :
> : Thanks,
> : Gery
> :
> : -- 
> : Gery D. Dorazio
> : Development Engineer
> :
> : EnQue Corporation
> : www.EnQue.com
> : www.ImagingHardware.com
> :
> :
>
>

Relevant Pages

  • Re: HELP PLEASE The request failed with HTTP status 401: Access Denied.
    ... Web Security: Part 2: Introducing the Web Application Manager, Client ... Authentication Options, and Process Isolation ... It introduces the Web Application Manager in IIS that ... logon session, which is dangerous. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • [Full-disclosure] [GOATSE SECURITY] Clench: Goatses way to say "screw you" to certificate author
    ... Application layer authentication-inherent validation of public key ... Goatse Security’s new simple password-based authentication mechanism ... getting hundreds of thousands or millions of users to install a client ... client hashes locally and then sends the hash to the server. ...
    (Full-Disclosure)
  • Re: WCF security advice (and clarification) needed
    ... You, the client, resolve the foo.mycompany.com hostname within your ... TCP/IP) with that ticket as the security token. ... There are two parties participating in a security scenario, the server ... HTTP supports other authentication ...
    (microsoft.public.dotnet.framework.webservices)
  • RE: 401.2 Errors
    ... the server name as their proxy server, ... really understand the point in deploying the Firewall Client to all clients. ... I had a look at the log file but it only seems to be ... recording access that the IIS Server itself goes through. ...
    (microsoft.public.windows.server.sbs)
  • Re: WM5 can not sync to exchange
    ... I checked all the authentication settings and they are as you requested. ... After running the internet connection wizard I had to uncheck the Require ... On the SBS 2003 Server open the Server Management console. ... Open IIS Manager ...
    (microsoft.public.windows.server.sbs)