Microsoft KB Archive/242772

= Site Server Forms Authentication May Not Work in a Reverse Proxy Environment =

Article ID: 242772

Article Last Modified on 10/16/2002

-

APPLIES TO


 * Microsoft Site Server 3.0 Standard Edition

-



This article was previously published under Q242772



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
The Site Server Forms Authentication ISAPI filter Authfltr.dll returns a relative HTTP 302 redirect response. Depending on the reverse proxy mapping configuration, this can break reverse proxy functionality.



CAUSE
This behavior is compliant with RFC 2048.



RESOLUTION
To resolve this problem, obtain the latest service pack for Site Server 3.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

219292 How to Obtain the Latest Site Server 3.0 Service Pack



STATUS
This problem was first corrected in Site Server 3.0 Service Pack 3.



MORE INFORMATION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To enable the sending of absolute redirects, use the following steps:  Start Registry Editor (Regedt32.exe). Locate the following key in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Site Server\3.0\P&M

 On the Edit menu, click Add Value, and then add the following registry value:

Value Name: UseAbsoluteRedirects

Data Type: REG_DWORD

Value: 1

 Quit Registry Editor.</ol>

If the above value is not present, the code functions the same as in prior versions. In other words, it will continue using relative redirects.

Site Server Forms Authentication traps any unauthorized requests to pages on a virtual Web server and issues a redirect to the FormsLogin.asp page. The content of this redirect depends on where the FormsLogin.asp file is. By default, this is in _mem_bin in the root of the virtual Web server. This results in a redirect containing a header ref "Location: /_mem_bin/FormsLogin.asp," (a relative redirect) being sent back to the client. In a reverse proxy environment, the proxy server may have a number of mappings configured that parse and rewrite header information. For example, it intercepts any request from a client with a header containing the extranet FQDN and replaces it with the corresponding intranet site name. When you use the same Forms Authentication page for multiple virtual Web servers, a loss of information occurs on the site where the original request came from.

Additional query words: froms authentication redirect reverse proxy

Keywords: kbbug kbfix kbqfe KB242772

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.