Obscure IIS7 ISAPI Filter problem

Question

Hey,

I am currently trying to migrate a legacy ASP application from Windows Server 2000 and IIS5 on to Windows Server 2008 and IIS7. The authentication for this application uses an ISAPI filter. Both the application and the ISAPI filter work in the new environment except for one problem. The application in question is set up to be the root application (as in you access it by going to http://hostname/application.asp). If I access it by the stated URL, it asks for my authentication details, the ISAPI filter gets passed the correct login details and then does its thing. Then I added a default document to IIS7 to point to application.asp. Now if I access the application by going to http://hostname, the ISAPI filter gets passed the wrong login details. The ISAPI filter implements this method:

DWORD CMyISAPIFilter::OnAuthentication(CHttpFilterContext* pCtxt, PHTTP_FILTER_AUTHENT pAuthent)

In it, the pAuthent object gets passed in by IIS when it calls the ISAPI filter and has the pszUser property which normally holds the value entered in the authentication dialog. In my case (when accessing the website by using the default document entry), the pszUser property holds the value of the Windows account that is running the application pool instead. Just to make things clear, the ISAPI filter gets passed the correct value if I type in the application.asp part.

I'm quite stumped at this problem and have no clue as to how to solve it. To make matters workse I can't really rebuild/modify the ISAPI filter and am quite the beginner when it comes to IIS administration.

I have also found that authentication works if IIS does not have the Default Document feature installed. Without this feature the default document does not work (naturally) but authentication does. It's only after I add the Default Document feature that authentication breaks.

Thanks for your help!

Answer 1

Sounds like the web site is configured to use integrated security on the root level. Make sure you remove the checkmark from the Integrated Windows Authentication checkbox in the Directory Security-Tab.

The Node "Web Sites" can be configured as well. So make sure you don't miss that one ;-)

EDIT: Damn i can't upload a picture. Would make it easier for you to find the setting.