Questions[isapi](server)

I have created an ISAPI filter for IIS 6.0 that tries to authenticate against Active directory using LDAP. The filter works fine when authenticating regularly over port 389, but when I try to use SSL, I always get the 0x51 Server Down error at the ldap_connect() call. Even skipping the connect call and using ldap_simple_bind_s() results in the same error.

The weird thing is that if I change the app pool identity to the local admin account, then the filter works fine and LDAP over SSL is successful. I created an exe with the same code below and ran it on the server as admin and it works. Using the default NETWORK SERVICE identity for the site's app pool is what seems to be the problem. Any thoughts as to what is happening? I want to use the default identity since I don't want the website to have elevated admin privileges.

The server is in a DMZ outside the network and domain where our DCs are that run AD. We have a valid certificate on our DCs for AD as well.

Code:

// Initialize LDAP connection
LDAP * ldap = ldap_sslinit(servers, LDAP_SSL_PORT, 1);
ULONG version = LDAP_VERSION3;

if (ldap == NULL)
{
    strcpy(error_msg, ldap_err2string(LdapGetLastError()));
    valid_user = false;
}
else
{
    // Set LDAP options
    ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, (void *) &version);
    ldap_set_option(ldap, LDAP_OPT_SSL, LDAP_OPT_ON);

    // Make the connection
    ldap_response = ldap_connect(ldap, NULL); // <-- Error occurs here!

    // Bind and continue...
}

UPDATE: I created a new user without admin privileges and ran the test exe as the new user and I got the same Server Down error. I added the user to the Administrators group and got the same error as well. The only user that seems to work with LDAP over SSL authentication on this particular server is administrator.

The web server with the ISAPI filter (and where I've been running the test exe) is running Windows Server 2003. The DCs with AD on them are running 2008 R2.

Also worth mentioning, we have a WordPress site on the same server that authenticates against LDAP over SSL using PHP (OpenLDAP) and there's no problem there. I have an ldap.conf file that specifies TLS_REQCERT never and the user running the PHP code is IUSR.

I have a web application using an ISAPI filter (written in c\c++) and OleDB to connect to a SQL Server 2008. The application works fine on a certain number of Windows Server 2008 R2.

Recently I found another server, also Windows 2008 R2, where the application is really slow.
I wrote a simple console application using C# and OleDB and I found it is really slow when executing a simple query like SELECT GETDATE(). I figured out that the something is wrong at the OleDB level, but I'm now stuck.

SQL Server is installed on a different server on the same subnet and there are no firewalls between the Web Server and SQL Server.

My test environment was:
S1: server 2008 (64bit)
S2: server 2008 (64bit)
S3: server 2003 (32bit)

all servers were running SQL Server 2008 and are on the same network (using a switch)
I ran my C# application executing SELECT GETDATE() in the following configuration (the first server is where the C# app is running, the second is where SQL SERVER is)

S1 -> S1 <1ms
S1 -> S3 5ms
S1 -> S2 300ms
S2 -> S2 <1ms

Any idea on how to proceed in the investigation?

In IIS7, we have an application which comes supplied as a .dll file. Application is known to work in II6 on a different server.

When browsing the URL of this application, it sends the .dll itself as a binary file (giving prompt of "Download: do you want to open or save this file" in the browser). For the application to work, we want ISAPI to run the DLL and send the resulting HTML.

What could be the problem? What needs to be configured to make this work? We've tried adding the specific .dll file to both IsApiFilters or to a Script Map in HandlerMappings (using handler IsApiModule). Module list shows that IsApiModule is Loaded.

The server-wide list of Handler mappings shows ISAPI-dll in the Disabled section with Path:"*.dll", Path type: "file". Is this entry relevant? Can it somehow be moved into the Enabled section?

[using IIS Manager GUI to edit settings]

When attempt to browse my Mercurial repositories it usually takes several refreshes before the repository list is displayed. The configuration is as follows:

• Windows Server 2003 (Dedicated machine hosted by http://www.server4you.com/.
• Site has anonymous password protection with self-signed SSL.
• Mercurial 1.5.3
• Python 2.6.5
• Python for Windows 32 extensions 214 py2.6
• isapi-wsgi 0.4.2

The repositories are being served via ISAPI using the standard hgwebdir_wspi.py file (copy to follow).

Also before doing a clone/push/etc I have to browse the repositories first otherwise hg on my local machine can not locate the site.

What can I do to start tracking down this problem?

hgwebdir_wsgi.py

# Configuration file location
hgweb_config = r'C:\Public\Mercurial\WebSite\hgweb.config'

# Global settings for IIS path translation
path_strip = 0   # Strip this many path elements off (when using url rewrite)
path_prefix = 0  # This many path elements are prefixes (depends on the
                 # virtual path of the IIS application).

import sys

# Adjust python path if this is not a system-wide install
#sys.path.insert(0, r'c:\path\to\python\lib')

# Enable tracing. Run 'python -m win32traceutil' to debug
if hasattr(sys, 'isapidllhandle'):
    import win32traceutil

# To serve pages in local charset instead of UTF-8, remove the two lines below
import os
os.environ['HGENCODING'] = 'UTF-8'


import isapi_wsgi
from mercurial import demandimport; demandimport.enable()
from mercurial.hgweb.hgwebdir_mod import hgwebdir

# Example tweak: Replace isapi_wsgi's handler to provide better error message
# Other stuff could also be done here, like logging errors etc.
class WsgiHandler(isapi_wsgi.IsapiWsgiHandler):
    error_status = '500 Internal Server Error' # less silly error message

isapi_wsgi.IsapiWsgiHandler = WsgiHandler

# Only create the hgwebdir instance once
application = hgwebdir(hgweb_config)

def handler(environ, start_response):

    # Translate IIS's weird URLs
    url = environ['SCRIPT_NAME'] + environ['PATH_INFO']
    paths = url[1:].split('/')[path_strip:]
    script_name = '/' + '/'.join(paths[:path_prefix])
    path_info = '/'.join(paths[path_prefix:])
    if path_info:
        path_info = '/' + path_info
    environ['SCRIPT_NAME'] = script_name
    environ['PATH_INFO'] = path_info

    return application(environ, start_response)

def __ExtensionFactory__():
    return isapi_wsgi.ISAPISimpleHandler(handler)

if __name__=='__main__':
    from isapi.install import *
    params = ISAPIParameters()
    HandleCommandLine(params)

hgweb.config

[paths]
/ = C:\Public\Mercurial\Repositories\*

[web]
allow_archive = bz2 gz zip      ; Allows archive downloads.
allow_push = ########       ; Users that are allowed to push.

I've got an F5 Big-IP that is mangaged by our hosting provider. It's dedicated to our private VLAN, etc. Works great :)

We requested them to add in an X-Forwarded-For HTTP-Header field. They've done that and we can now access that in the code. Awesome :)

But .. for our IIS logs, it's still the IP of the F5 machine. I think I was told that we need to apply an ISAPI filter (cringe!) to the IIS server(s).

1. Can someone confirm this?
2. If #1 == yes, is there a file/instructions how to do this for our IIS7 web servers on windows 2008 machines.