SCA Passing Client Certificate to Back End Server Problem

[nalcomis75]

We are trying to pass a client certificate from the SCA to a back end IIS server so that the IIS server can authenticate the user against Windows AD. When we enable the Add Client Certificate Info option in the "Add HTTP Headers to backend HTTP Stream" section, the IIS server returns an HTTP 400 "Bad Request" response. What options do we need to set to have the SCA successfully pass a client certificate to the back end IIS server?

[Gilles Dufour]

is the backend clear text ?

If so, capture a sniffer trace to see the header after doing client certificate insertion.

Unless there is a bug I don't see why it fails.

It surely works for me.

Gilles.

[nalcomis75]

Gilles,

Attached are my configs and packet caputers, both in front and behind the CSS. There are 4 total attachments. 3 in this post and 1 in the next thread (due to your 3 attachment limit). The packet captures are in Ethereal format.

What version software are you running on your SCA? A bug sounds very possible. I recently upgraded to the latest version. I never tried it with the older. Thanks.

-Erik

[nalcomis75]

My final attachment. Note: I changed the backed port from 5150 to standard port 80 to simplify trouble-shooting. Thanks.

[Gilles Dufour]

I don't see anything wrong in the info sent by the CSS/SCA.

Looks like the server says "invalid header" but I can't find which one is invalid.

Looks like a microsoft bug to me.

Do you have an Apache server somewhere to test with ?

What you can also try is extract the clear text header and try to send it using a script to the IIS server.

Remove one header line at a time and see which one the IIS server is complaining about.

I can do this myself but it may take a few days for me to find the time.

Gilles.

[nalcomis75]

Gilles,

Have you guys tested this config on Win2k3 with IIS 6.0?

[efairbanks]

Gilles,

What version IIS have you seen this work with? Thanks.

-Erik