Click here to Skip to main content
15,921,028 members
Articles / Web Development / IIS

Usage of the Client Authorization in an ISAPI Extension

Rate me:
Please Sign up or sign in to vote.
3.19/5 (18 votes)
3 Aug 20042 min read 37.1K   18  
An article on how the authorization can be used in a ISAPI Extension


Normally, the ISAPI extension gets a request after the authentication was successful by the IIS engine. If there is, for example, a database connection, and you want to use a user input for username and password for the database connection, you will use an HTML Form to ask for that. Why not use the standard browser authorization dialog for that? Because, the database user is not a valid Windows user and authentication fails! OK, can be, but is it impossible to use it nevertheless? No, you must read on!


In the ISAPI extension, we search for the HTTP_AUTHORIZATION header. If we do not find anything, we reject the request with "HTTP/1.1 401.5 Access Denied". The browser prompts for username and password. After the client has sent us the authentication information, we can use a ISAPI Filter to catch the OnAuthentication event and set the username back to anonymous. What is the result? The IIS engine calls our extension as anonymous, but the HTTP_AUTHORIZATION header is still present, so we can use it. ;o) Great!

The Code for the Filter

Put this in the OnAuthenticate method and define a constant with the name of your ISAPI extension DLL. Why? We would do this only if the user called our extension.

#define MODULNAME "myextension.dll"
// this is code for the Filter
    //  Tell the server to notify any subsequent
    // notifications in the chain
// retrieve the URL, so that we can look for our own extension 
char szURL[1024];
DWORD dwSize = sizeof(szURL);
if(pCtxt->GetServerVariable(HEADER_URL, szURL, &dwSize) == TRUE)
    if(strstr(_strlwr(szURL), MODULNAME) != 0)
        // it is our own extension
        // clear all for reset to anonymous
        pAuthent->pszUser[0] = pAuthent->pszPassword[0] = '\0';

The Code for the Extension

Put this in your extension. We would do this only if the user called our extension. To decode the BASE64 encoded Username:Password, I used a class called Base64Coder found here.

static const TCHAR szAuthRequired[] = _T("HTTP/1.1 401.5 Access Denied\r\n
       WWW-Authenticate: Basic realm=\"my own realm\"\r\nContent-Length: 837\r\n
       Content-Type: text/html\r\n\r\n.....");
// this code for the Extension

CString m_strUserName;
CString m_strPassword;

char szAUTHORIZATION[1024] = "";
DWORD dwSize = sizeof(szAUTHORIZATION);
              szAUTHORIZATION, &dwSize) == TRUE)
    if(strstr(szAUTHORIZATION, "Basic ") != NULL)
        char szdecode[1024];
        char szdata[1024];
        char sztmp[1024];
        char *pdest;
        int  pos;
        Base64Coder  Coder;

        strcpy(szdecode, szAUTHORIZATION + 6);
        strcpy(szdata, Coder.DecodedMessage());
        pdest = strstr(szdata, ":");
        pos = pdest - szdata + 1;

        if(pos <= 0)
            pCtxt->m_bSendHeaders = FALSE;
            dwSize = strlen(szAuthRequired);
            pCtxt->WriteClient(szAuthRequired, &dwSize, 0);
            strcpy(sztmp, szdata);
            sztmp[pos - 1] = '\0';
            m_strUserName = sztmp;
            strcpy(sztmp, szdata + pos);
            m_strPassword = sztmp;
            // now we know the username and the password and 
            // can use it for anything. If the values are not 
            // valid you can post a message or use the code to
            // post a access denied
        // we only support Basic authorization

If you want, you can put the code for the filter and the extension in one DLL.


This only works if basic authentication is active. I suggest to use it only in combination of SSL, so that the communication between IIS server and browser is encrypted.


// Copyright (C) 2004 LEAN Software Production
if((this == "nice") || (this == "great")) 
    pReponse->SetHeader(pfc, (char*) _T("great-stuff:"), (char*) _T("true"));
    return SF_STATUS_REQ_ERROR; 

Please rate this article for me! 


  • Version 1.0 - Prepared for uploading


This article has no explicit license attached to it, but may contain usage terms in the article text or the download files themselves. If in doubt, please contact the author via the discussion board below.

A list of licenses authors might use can be found here.

Written By
Germany Germany
Interested about me, then ask

Comments and Discussions

-- There are no messages in this forum --