IIS 6.0 IWA and ISAPI filter question

Hi,


We have IIS 6.0 configured with an ISAPI filter. IIS
is set with no authentication for the filter URI. The
ISAPI DLL forwards the request to a third party server
that executes IWA.

When the third party server is set to require "Negotiate"
and the access is made from a different computer than the
IIS one (user logged into the domain), browser's first
handshake "Authorization" header is more then 1800 bytes.
In this case this header is not forwarded to the filter.

Checking off-line, I have seen that if the header value is
longer then 1024 the header is not forwarded to the filter.
The 1024 length applies only to the "Authorization" header,
other headers allowing for longer values.

Is there any setting we can change to increase the allowed
length for the "Authorization" header?

MaxFieldLength and MaxRequestBytes are not set.

When we use NTLM instead of Negotiate or we access IIS from
the same computer or we use a non-domain account for the
browser then the "Authorization" header is much smaller and
everything works OK.


Thank you,
George

I am not aware of any such limits on a specific header name.

Are you sure it's not the filter that has a buffer limit of some sort? I
mean, this filter is working like a proxy for the client -- and if it wants
to preserve authentication (i.e. IIS is configured to not look at
authentication), it's got to be processing the incoming request, in
particular the Authorization and WWW-Authenticate headers.

I presume this filter is ReadRawData and requires you to run in IIS5
Compatibility Mode, at which point the filter is completely responsible for
reading and buffering the incoming request and forwarding it off the server.
The filter should be receiving all the request header data.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"George Aprotosoaie" <g.aprotosoaie.RemoveThis@computer.org> wrote in message
news:8vWub.118401$HoK.18956@news01.bloor.is.net.cable.rogers.com...
Hi,


We have IIS 6.0 configured with an ISAPI filter. IIS
is set with no authentication for the filter URI. The
ISAPI DLL forwards the request to a third party server
that executes IWA.

When the third party server is set to require "Negotiate"
and the access is made from a different computer than the
IIS one (user logged into the domain), browser's first
handshake "Authorization" header is more then 1800 bytes.
In this case this header is not forwarded to the filter.

Checking off-line, I have seen that if the header value is
longer then 1024 the header is not forwarded to the filter.
The 1024 length applies only to the "Authorization" header,
other headers allowing for longer values.

Is there any setting we can change to increase the allowed
length for the "Authorization" header?

MaxFieldLength and MaxRequestBytes are not set.

When we use NTLM instead of Negotiate or we access IIS from
the same computer or we use a non-domain account for the
browser then the "Authorization" header is much smaller and
everything works OK.


Thank you,
George