# Finally solved: Windows Auth via IIS6 proxied to mongrel **URL:** \ **Category:** Rails\ **Created:** [December 13, 2006, 6:38pm UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268 "2006-12-13T18:38:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [December 13, 2006, 6:38pm UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/1 "2006-12-13T18:38:18Z")
after struggling for quite a while i finally solved my problem to use windows authentication in my rails app. maybe some of you are trying to achieve the same and documentation about this is quite hard to find so i thought it’s a good idea to share this here… after i stopped trying to run my rails app directly on IIS (which never REALLY worked) i tried the commercial ISAPI\_Rewrite from helicon with a RewriteProxy rule and my app running on mongrel with the “reverse\_proxy\_fix” plugin. after installing the ISAPI\_Rewrite filter on the windows server you need to → run “proxycfg.vbs -r” inside the installation folder “C:\Program Files\Helicon\ISAPI\_Rewrite” → edit the httpd.ini there and add a rewriteproxy rule like RewriteProxy /test(.\*) http://the\_host\_where\_mongrel\_runs:3000/$1 [I,U,D,A] → enable windows authentication in IIS and restart IIS (iisreset) → install the revers proxy fix via: ruby script/plugin install [http://svn.napcsweb.com/public/reverse\_proxy\_fix](http://svn.napcsweb.com/public/reverse_proxy_fix) and enter the url where you want to run the app (e.g. [http://domain/test](http://domain/test)) → fire up mongrel → let IIS do the auth and harvest the name of the authenticated user via request.env[‘HTTP\_X\_ISRW\_PROXY\_AUTH\_USER’] and do some authorizations or deny access as you like → be happy (at least i am now!!!) i hope this is of help to someone regards neongrau ---
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [December 13, 2006, 6:51pm UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/2 "2006-12-13T18:51:07Z")
Looks like a great FAQ addition! ---
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [December 15, 2006, 11:04pm UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/3 "2006-12-15T23:04:29Z")
Okay…now do you have a set of rewrite rules for all of the non rails generated links (such as straight javascript code) that the reverse\_proxy\_fix plugin doesn’t handle? I’ll give you $100 for them! We messed around with the IIS reverse proxy from salty pickle, but there were some errors in its rewrite rules that I didn’t feel like debugging today. It looks like you could add one line of code to their logic in creating the proxy request to put the auth\_user in the HTTP headers. I would caution anyone doing this, or any other reverse proxy solution, to make sure that they don’t allow their mongrels to accept connections from anything other than IIS. The HTTP header is rather easily faked. On Dec 13, 12:38 pm, Ralf V. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [December 16, 2006, 12:33pm UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/4 "2006-12-16T12:33:48Z")
matt mcknight wrote: > Okay…now do you have a set of rewrite rules for all of the non rails > generated links (such as straight javascript code) that the > reverse\_proxy\_fix plugin doesn’t handle? I’ll give you $100 for them! hmm i don’t have any such rules, all i needed was a RewriteCond to distinguish the hostname where rails app runs from the other sites on IIS and a single RewriteProxy rule. since i don’t have static/absolute pathes in any of my javascript code everything just works. can you give an example how those links look like that don’t work when proxied? > We messed around with the IIS reverse proxy from salty pickle, but > there were some errors in its rewrite rules that I didn’t feel like > debugging today. It looks like you could add one line of code to their > logic in creating the proxy request to put the auth\_user in the HTTP > headers. haven’t seen or tried that saltypickle tool, as i stated i used the commercial one from helicontech (so far just the 30 day trial) but the prices for the full version are ok imho. ---
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [December 18, 2006, 6:04am UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/5 "2006-12-18T06:04:13Z")
Ralf V. wrote: > can you give an example how those links look like that don’t work when > proxied? Ha- I was so deep in the problem that I forgot what I was doing with root paths. I had some links in the that begin with a “/”, and they weren’t getting rewritten. Of course they all work perfectly with Apache mod\_proxy, so I just assumed it was a problem with the ISAPI\_Rewrite thing and I’d have to go and try to recreate some of those rewrite rules from Apache. The obvious workaround is to use the “…/…/” style links in the app, although those can be tricky if you attempt re-use the code in things that live at different virtual directory depths. Small price to pay for getting that request property populated. Thanks again for your post! Matt ---
**Author:** ![neongrau](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/34f0e0/32.png) [@neongrau](https://www.ruby-forum.com/u/neongrau)\ **Post date:** [February 2, 2007, 4:33am UTC](https://www.ruby-forum.com/t/finally-solved-windows-auth-via-iis6-proxied-to-mongrel/79268/6 "2007-02-02T04:33:47Z")
Matt: If you use my reverse\_proxy\_fix plugin and make sure all your URLS in Rails use the built-in helpers, links work fine. Avoid doing any hard-coded paths (javascript\_include\_tag, link\_to, stylesheet\_link\_tag) and my plugin will take care of directing traffic back around. The main reason I wrote the plugin was to prevent the backend server from being exposed. to the user (the frontend server name and port are prefixed to all requests from the user side).