Remote_User for MS IIS 7 + Weblogic 10.3 ?

Question

Hi all,
i have a problem using IIS 7.0 (Windows Server 2008) and Weblogic Server 10.3 together using the IntegratedWindowsAuthentication(Negotiate/NTLM). Via the iisForward.dll (as ISAPI Filter) and iisproxy.dll i forward all requests to a WebLogic instance, but the request.getRemoteUser() method on the WebLogic page always returns 'null'.The authenticated user appears in the Header as 'Proxy-Remote-User', which i guess is set by the iisproxy.dll, but that doesnt help, because our web application needs the getRemoteUser() of the request beeing set. Using the same configuration with Apache Tomcat 6.0 (setting tomcatAuthentication to false) or WebLogic 8.1 i get a value for getRemoteUser(). Did anything change since then ? How can i make Weblogic forward the RemoteUser attribute now ? Do i need SSL ? I also tried using the WindowsNTAuthenticator instead of the DefaultAuthenticator but got the same result...
I'm not an expert, but the request object looks fine to me:
request.getHeader("REMOTE_USER"): null
request.getHeader("XXX_REMOTE_USER"): null
request.getRemoteUser(): null
request.getUserPrincipal():null
request.getMethod(): GET
request.isSecure(): false
request.getProtocol(): HTTP/1.1
request.getAuthType(): null
request.getServerPort(): 80
request.getServerName(): mozart.testdomain.de
request.getContextPath():/test
request.getRemoteHost(): 127.0.0.1
request.getRemoteAddr(): 127.0.0.1
request.getScheme(): http
request.getCharacterEncoding(): null
request.getPathInfo(): null
request.getPathTranslated(): null
request.getQueryString(): null
request.getRequestURI(): /test/test.jsp
request.getRequestedSessionId(): ktWBJ2sZc4FnZ8FWtLL65FRMZCWN12c5CJphTK0jfmLd2hnZxGmt!-1027846612!1241426969451+
request.getServletPath(): /test.jsp
request.getContentType(): null
request.getHeaders(Cache-Control): no-cache
request.getHeaders(Accept): \*/\*
request.getHeaders(Accept-Encoding): gzip, deflate
request.getHeaders(Accept-Language): de
request.getHeaders(Cookie): hcl2.login=-GBGEGNGJGO; VIPKNOWNUSER=1239695321547; hcl2.profile_pomaAdmin=IWRlZmF1bHQ-; JSESSIONID=ktWBJ2sZc4FnZ8FWtLL65FRMZCWN12c5CJphTK0jfmLd2hnZxGmt!-1027846612
request.getHeaders(Host): mozart.testdomain.de
request.getHeaders(User-Agent): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
request.getHeaders(UA-CPU): x86
request.getHeaders(Connection): Keep-Alive
request.getHeaders(Proxy-Client-IP): ::1
request.getHeaders(X-Forwarded-For): ::1
request.getHeaders(X-WebLogic-KeepAliveSecs): 30
request.getHeaders(X-WebLogic-Force-JVMID): -1027846612
request.getHeaders(Proxy-Remote-User): TESTDOMAIN\Administrator
request.getHeaders(Proxy-Auth-Type): Negotiate
I hope anyone knows a solution for this, spend already much time on this. Thanks in advance!
Edited by: user11128218 on 04.05.2009 02:36

Answer 1

WLS intentionally returns "null" for
getRemoteUser() call to guard against a security vulnerability.
However, to support applications which depend on this method, it does provide
the following system flag. To get the value from the REMOTE_USER header in
the request through the getRemoteUser() call, you need to start the WLS
server with the following JVM System flag.
-Dweblogic.http.enableRemoteUserHeader=true
Important Note:
Please be informed that by enabling this feature, the system would be
vulnerable to the REMOTE_USER HTTP header spoofing.