Instructions for mixed authentication in connection with IIS as reverse proxy and Intrexx as of version 19.03 for the simultaneous use of Integrated Authentication (SSO / Windows authentication) and Intrexx authentication (and/or LDAP authentication).

The following scenario describes a portal that can be used internally via Windows authentication and externally via a second page in IIS with Intrexx authentication. Classic scenario of a portal that is to be available both on the LAN (IIS page 1) and on the Internet (IIS page 2).

Please note that in this scenario either:

a. two different URLs (base URL) must be worked with, in which case, however, Intrexx cannot be used to its full extent. Functions that function on the basis of the URL are limited in this case, since the portal is thus called with two URLs; possible problems form, for example, links that point to the Intrexx portal.

b. an upstream reverse proxy must be used, which can distinguish between the networks and process the calls on the same URL, but can route them to different IP addresses to the frontend web server (IIS).

This is necessary because a separation of the calls must take place in the IIS. This is done either by host binding (variant a) or by IP assignment (variant b). Only in this way can the IIS authenticate users with the Integrated Authentication (SSO / Windows Authentication) via page 1 and the Anonymous Authentication (Intrexx Auth, LDAP Auth.) via page 2.

In addition, it should be noted that the necessary DNS entries as well as the possibly used IP address bindings are functional and can be used.You can test the DNS entries by creating a page in the IIS and storing the default page of the IIS as a directory (C:\inetpub\wwwroot). Make sure that only one of the pages in the IIS is active during this test, as this is the only way to ensure that the correct page (page1 / page2) receives the call.
The starting point is a functioning portal with the IIS as the frontend web server and an Intrexx authentication.