Getting SPNEGO HTTP headers to a CGI?

Hi all,

trying to get the following setup to work:

Http SPNEGO SPNEGO via CORBA
IE <---------------------> IIS <---> CGI
<--------------------------------> AppServer

So basically using IIS as a primitve frontend for an AppServer that
can do Kerberos Auth itself (via SSPI or GSSAPI). The AppServer may be
on Windows but it may be on some Unix host, shouldn't matter.

Basically i would need to put the HTTP auth headers into the CGI
environment somehow but didn't find any IIS docs about it.

Not sure if this would work:

register an SPN HTTP/somevirtualhost.example.com@xxxxxxxxxxx and let
the AppServer use that SPN with its call to SSPI AcquireCredentials()/
InitializeSecurityContext(). Now configure IIS somehow to pass all
Auth headers for http://somevirtualhost.example.com/.* to my CGI that
simply forwards stuff to the AppServer.

I know that its in principle unsafe to pass such info through CGI
environment vars, but for SPNEGO based Kerberos tokens it shouldn't
matter, those are designed for unsafe networks.

So is there a simple way to do this with IIS (handle auth stuff on the
CGI level)?

Michael
.

Relevant Pages

  • Re: Getting SPNEGO HTTP headers to a CGI?
    ... Why are you trying to do this throught IIS rather than through a reverse proxy? ... The AppServer may be ... Basically i would need to put the HTTP auth headers into the CGI ...
    (microsoft.public.inetserver.iis.security)
  • Re: ActiveDirectoryMembershipProvider woes
    ... Win auth essentially means you are offloading to IIS, so it depends on the IIS auth settings. ... Integrated will challenge for creds if SSO can't be made to work, so that's where the fiddling with IE settings may come into play. ... You basically don't get referrals. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication Redirect to login doesnt work
    ... If you are using windows/basic auth in IIS - IIS will do the authentication ... you set IIS to do no authentication - and do it yourself ... windows integrated for windows NT auth. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • support: on / off sync issues
    ... whenever I make a change in the IIS console and or restart the IIS ... all the phones switch their settings from their usual sync ... cause the phones to set themselves to "manually sync". ... defaultwebsite - intergrated windows auth + basic auth ...
    (microsoft.public.pocketpc)
  • One config file for IIS and custom app server
    ... we usually use IIS as appserver, but for one customer we are not allowed to ... For this reason we have written our own appserver to host the remote ... not possible to specify the port for a channel in web.config. ...
    (microsoft.public.dotnet.framework.remoting)