The IIS Basic Authentication Problem

The Problem

Did you know that the basic authentication in IIS authenticate HTTP connections, not HTTP requests?

It is well known that Windows Integrated Authentication (NTLM and SPNEGO) authenticates HTTP connections, not each HTTP request, but it has come to my attention that this has been also applicable to HTTP basic authentication on IIS. This bug breaks most HTTP reverse proxies / intermediaries who do some kind of sharing / aggregation of backend HTTP connections.

When this bug applies to an Orenosp environment, you could see one or many of the following problems: In my testing, this bug does seem to have been fixed in IIS 6.0, but please read the following section.

Applicable Systems

This problem is observed by third parties with at least IIS 5.0 and IIS 5.1. I have observed this problem on IIS 5.0 but NOT on IIS 6.0. However, Microsoft KB323574 suggests that this problem is also applicable to IIS 5.0, 5.1 and 6.0. To prevent any security problems from now on Orenosp will assume that all IIS versions and all other HTTP servers as well are broken in this regard and take corrective actions.

Orenosp version 0.8.0 will include a fix to work around this problem still maintaining aggregated backend connections.

Internals

Orenosp maintains a central pool of cached backend connections to improve performance. All backend connections are stored in this pool except for connections on which Windows Integrated Authentication (NTLM/SPNEGO) activity was observed. Those NTLM/SPNEGO connections are treated differently in that they are attached to the client connection, not to the central pool.

One way to combat this bug would be for Orenosp to treat all IIS connections as NTLM/SPNEGO connections and do not cache them globally. However, doing so would kill great performance win in Orenosp. Since basic authentication is simple and clearly defined (unlike NTLM/SPNEGO authentication), Orenosp can group basic-auth'ed connections into each authenticated users and restrict reuse scope within that. In another words, Orenosp will use (server, username) pair, rather than just (server), as the cache key. This will be implemented in 0.8.0 and enabled for all basic-auth'ed backend connections. This will be effective for all kinds of backend servers, not just for IIS.

Links

Created on 2004/11/2