Home / server / Questions / 461272
Accepted
Wayne Werner
Asked: 2012-12-28 13:07:07 +0800 CST

How do I get Nginx to pass authentication on to IIS as a reverse proxy?

  • 772

I have the following setup in my Nginx (1.2.6 on Windows 7) conf file:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
}

On server_two I have IIS7 running a WCF service that uses basic authentication. When I visit http://server_two:8888/FOO/Service.svc?wsdl I get the correct endpoint.

When I visit http://myhost/FOO/Service.svc?wsdl I get a user/pass box that pops up. I can enter my credentials until the cows come home and still nothing. I've also tried the following:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
    proxy_set_header Host $host;
    proxy_set_header X-Accel-Expires 0;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

And several other variants, but as yet I'm not able to get the login process to work. Is this possible with Nginx? What am I missing?

UPDATE:

I forgot to mention, IIS is setup to do an HTTP 401 Challenge for Windows Authentication

nginx

2 Answers

  1. Best Answer

    By default NGINX doesn't use keepalive on upstream connections and that may cause the authentication issue since the TCP connections are not maintained. I would try to turn the keepalive on. See http://nginx.org/en/docs/http/ngx_http_upstream_module.html

    • 2

  2. According to nginx documentation:

    Allows proxying requests with NTLM Authentication. The upstream connection is bound to the client connection once the client sends a request with the “Authorization” header field value starting with “Negotiate” or “NTLM”. Further client requests will be proxied through the same upstream connection, keeping the authentication context.

    The "ntlm" option is available only for Nginx Plus. I created a custom module that is able to provide a similar functionality

    gabihodoroaga/nginx-ntlm-module

    There is also a blog post about this at hodo.dev.

    • 0