ISAPI filter to set REMOTE_USER

Hi,

Background (highly summarized):

I have a scenario where:

* I have a proxy server in front of IIS
* I authenticate at that proxy server
* That proxy server injects a generic authorization header into the forward
stream to IIS
* I have both Basic Authentication and Integrated Windows authentication
activated on IIS
* IIS authenticates using the authorization header and sets REMOTE_USER
* But, that generic user is the wrong value

Summary:

Is it possible to write an ISAPI filter that will modify REMOTE_USER after
it has been set by NTLM authentication? I have the desired user value in
another variable, so the logic for the ISAPI filter is:

if PROXY_USER != blank then REMOTE_USER = PROXY_USER

My concern is that REMOTE_USER is "special" and cannot reliably be changed
in this scenario, so that is what I'm trying to confirm.

And, of course, if you have any code that modifies REMOTE_USER with the
value from another variable, I would really appreciate any sample code.

Cheers,
Scott

Hi Scott,

The REMOTE_USER server variable is set by IIS authentication, and a filter
cannot change it.

If you are using IIS 6, then you can write a wildcard script map that uses
HSE_REQ_EXEC_URL, and it can directly set REMOTE_USER for the child request.

Thank you,
-Wade A. Hilmo,
-Microsoft

PS: If you have any other questions on this, or any other, ISAPI issue,
please feel free to use the
microsoft.public.platformsdk.internet.server.isapi-dev newsgroup, which
exists for this purpose.

"Scott" <if_you_want_my_email_ask_in_a_post.RemoveThis@please.com> wrote in message
news:e#f8rBOgDHA.1088@TK2MSFTNGP10.phx.gbl...
 > Hi,
 >
 > Background (highly summarized):
 >
 > I have a scenario where:
 >
 > * I have a proxy server in front of IIS
 > * I authenticate at that proxy server
 > * That proxy server injects a generic authorization header into the
forward
 > stream to IIS
 > * I have both Basic Authentication and Integrated Windows authentication
 > activated on IIS
 > * IIS authenticates using the authorization header and sets REMOTE_USER
 > * But, that generic user is the wrong value
 >
 > Summary:
 >
 > Is it possible to write an ISAPI filter that will modify REMOTE_USER after
 > it has been set by NTLM authentication? I have the desired user value in
 > another variable, so the logic for the ISAPI filter is:
 >
 > if PROXY_USER != blank then REMOTE_USER = PROXY_USER
 >
 > My concern is that REMOTE_USER is "special" and cannot reliably be changed
 > in this scenario, so that is what I'm trying to confirm.
 >
 > And, of course, if you have any code that modifies REMOTE_USER with the
 > value from another variable, I would really appreciate any sample code.
 >
 > Cheers,
 > Scott
 >
 ><!-- ~MESSAGE_AFTER~ -->