3

I have the following setup in my Nginx (1.2.6 on Windows 7) conf file:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
}

On server_two I have IIS7 running a WCF service that uses basic authentication. When I visit http://server_two:8888/FOO/Service.svc?wsdl I get the correct endpoint.

When I visit http://myhost/FOO/Service.svc?wsdl I get a user/pass box that pops up. I can enter my credentials until the cows come home and still nothing. I've also tried the following:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
    proxy_set_header Host $host;
    proxy_set_header X-Accel-Expires 0;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

And several other variants, but as yet I'm not able to get the login process to work. Is this possible with Nginx? What am I missing?

UPDATE:

I forgot to mention, IIS is setup to do an HTTP 401 Challenge for Windows Authentication

Community
  • 1
Wayne Werner
  • 739
  • Shouldn't it be http://myhost/FOO/FOO/Service.svc?wsdl with your current config? – Mathias R. Jessen Dec 28 '12 at 00:23
  • 1
    @MathiasR.Jessen I just changed it to http://server_two:8888/$1 - I still get the authentication issues. As far as I can tell, it's not correctly passing the authentication (user/pass) through to IIS - or back again. That communication is broken somewhere – Wayne Werner Dec 28 '12 at 13:08

2 Answers2

2

By default NGINX doesn't use keepalive on upstream connections and that may cause the authentication issue since the TCP connections are not maintained. I would try to turn the keepalive on. See http://nginx.org/en/docs/http/ngx_http_upstream_module.html

Steven P
  • 36
0

According to nginx documentation:

Allows proxying requests with NTLM Authentication. The upstream connection is bound to the client connection once the client sends a request with the “Authorization” header field value starting with “Negotiate” or “NTLM”. Further client requests will be proxied through the same upstream connection, keeping the authentication context.

The "ntlm" option is available only for Nginx Plus. I created a custom module that is able to provide a similar functionality

gabihodoroaga/nginx-ntlm-module

There is also a blog post about this at hodo.dev.

Gabriel Hodoroaga
  • 111