Description of the update that implements Extended Protection for Authentication in Internet Information Services (IIS)

Configuration

• Channel binding information that is specified through a Channel Binding Token (CBT). This is used primarily for SSL connections.
  
• Service binding information that is specified through a service principal name (SPN). This is used primarily for connections that do not use SSL or when a connection is established. For example, this might be in a scenario in which SSL is offloaded to another device, such as a proxy server or load-balancer.

Extended Protection Scenarios

• In these scenarios, you could also specify the AllowDotlessSpn flag if your networking environment supports NetBIOS-based SPNs. However, NetBIOS-based SPNs are not secure.
  
• For the scenarios in which SPN checking will be used, and channel binding token checking will not be used, you should not specify the NoServiceNameCheck flag.
  
• Default installation of IIS 6.0, IIS 7.0, or IIS 7.5 does not enable or install Windows authentication. Extended Protection is applicable only when Windows authentication is enabled for your Web site or application.

Configuration on IIS 7.0 and 7.5

<windowsAuthentication enabled="false" />

How to enable Extended Protection for Windows authentication for IIS 7.5

1. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. 
   In the Connections pane, expand the server name, expand Sites, and then select the site, application or Web service for which you want to enable Extended Protection for Windows authentication.
   
3. Scroll to the Security section in the Home pane, and then double-click Authentication.
4. 
   In the Authentication pane, select Windows Authentication.
5. 
   Click Enable in the Actions pane.
6. 
   
   Click Advanced Settings in the Actions pane.
7. 
   When the Advanced Settings dialog box appears, select one of the following options in the Extended Protection menu:
   
   • Select Accept if you want to enable extended protection while providing down-level support for clients that do not support extended protection.
     
   • Select Required if you want to enable extended protection without providing down-level support.
     
     
8. Click OK to close the Advanced Settings dialog box.
   

How to enable Extended Protection for Windows authentication for IIS 7.0

Configuration

Attribute

Child Elements

Configuration Sample

<location path="Default Web Site">
   <system.webServer>
      <security>
         <authentication>
            <windowsAuthentication enabled="true">
               <extendedProtection tokenChecking="Allow" flags="None">
                  <spn name="HTTP/www.contoso.com" />
                  <spn name="HTTP/contoso.com" />
               </extendedProtection>
            </windowsAuthentication>
         </authentication>
      </security>
   </system.webServer>
</location>

Sample Code

AppCmd.exe

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /enabled:"True" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /extendedProtection.tokenChecking:"Allow" /extendedProtection.flags:"None" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/www.contoso.com']" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/contoso.com']" /commit:apphost

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetApplicationHostConfiguration();

         ConfigurationSection windowsAuthenticationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site");
         windowsAuthenticationSection["enabled"] = true;

         ConfigurationElement extendedProtectionElement = windowsAuthenticationSection.GetChildElement("extendedProtection");
         extendedProtectionElement["tokenChecking"] = @"Allow";
         extendedProtectionElement["flags"] = @"None";

         ConfigurationElementCollection extendedProtectionCollection = extendedProtectionElement.GetCollection();

         ConfigurationElement spnElement = extendedProtectionCollection.CreateElement("spn");
         spnElement["name"] = @"HTTP/www.contoso.com";
         extendedProtectionCollection.Add(spnElement);

         ConfigurationElement spnElement1 = extendedProtectionCollection.CreateElement("spn");
         spnElement1["name"] = @"HTTP/contoso.com";
         extendedProtectionCollection.Add(spnElement1);

         serverManager.CommitChanges();
      }
   }
}

Visual Basic .NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration
Module Sample
   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetApplicationHostConfiguration

      Dim windowsAuthenticationSection As ConfigurationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site")
      windowsAuthenticationSection("enabled") = True

      Dim extendedProtectionElement As ConfigurationElement = windowsAuthenticationSection.GetChildElement("extendedProtection")
      extendedProtectionElement("tokenChecking") = "Allow"
      extendedProtectionElement("flags") = "None"

      Dim extendedProtectionCollection As ConfigurationElementCollection = extendedProtectionElement.GetCollection

      Dim spnElement As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement("name") = "HTTP/www.contoso.com"
      extendedProtectionCollection.Add(spnElement)

      Dim spnElement1 As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement1("name") = "HTTP/contoso.com"
      extendedProtectionCollection.Add(spnElement1)

      serverManager.CommitChanges()
   End Sub
End Module

JavaScript

var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST";

var windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site");
windowsAuthenticationSection.Properties.Item("enabled").Value = true;

var extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection");
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow";
extendedProtectionElement.Properties.Item("flags").Value = "None";

var extendedProtectionCollection = extendedProtectionElement.Collection;

var spnElement = extendedProtectionCollection.CreateNewElement("spn");
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com";
extendedProtectionCollection.AddElement(spnElement);

var spnElement1 = extendedProtectionCollection.CreateNewElement("spn");
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com";
extendedProtectionCollection.AddElement(spnElement1);

adminManager.CommitChanges();

VBScript

Set adminManager = createObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST"

Set windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site")
windowsAuthenticationSection.Properties.Item("enabled").Value = True

Set extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection")
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow"
extendedProtectionElement.Properties.Item("flags").Value = "None"

Set extendedProtectionCollection = extendedProtectionElement.Collection

Set spnElement = extendedProtectionCollection.CreateNewElement("spn")
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com"
extendedProtectionCollection.AddElement(spnElement)

Set spnElement1 = extendedProtectionCollection.CreateNewElement("spn")
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com"
extendedProtectionCollection.AddElement(spnElement1)

adminManager.CommitChanges()

Configuration on IIS 6.0

1. Start Registry Editor. To do this, click Start, click Run, type regedit, and then click OK.
   
2. Locate and then click the following registry subkey:
   
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W3SVC\Parameters\extendedProtection\
   
3. Verify that the tokenChecking, Flags, and spns registry values are present.
   
   
   
   If these registry values are not present, follow these steps to create them:
   
   1. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
      
   2. Type tokenChecking, and then press ENTER.
      
   3. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
      
   4. Type flags, and then press ENTER.
      
   5. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click MULTI_SZ Value.
      
   6. Type spns, and then press ENTER.
      
4. Click to select the tokenChecking registry value.
   
5. On the Edit menu, click Modify.
   
6. In the Value data box, type the preferred value, and then click OK.
   
7. Click to select the flags registry value.
8. 
   In the Value data box, type the preferred value, and then click OK.
   
9. Click to select the spns registry value.
   
10. In the Value data box, enter an appropriate spn, and then click OK.
    
11. Exit Registry Editor.
    

Update information

Prerequisites for Windows Server 2003

Known issues

• Windows Server 2003
  
  This update was rereleased on March 9, 2010 to perform an additional check to make sure that the IIS 6 system on a computer that is running Windows Server 2003 SP2 does not contain binaries from the SP1 version. If such binaries are found, this update will exit with an error message. To fix this condition, reapply the SP2 update to your computers and install this package after you successfully reinstall SP2.
  
  The original version of this security update, released before March 9, 2010, could cause IIS application pools to not start on installations of Windows Server 2003 SP2 where IIS 6 may contain some SP1 binaries, IIS application pools may not start. The System log would display the following error message when the IIS service is started:
  Event ID 1009, Description: A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'
  For more information about this known issue, click the following article number to view the article in the Microsoft Knowledge Base:
  
  
  2009746 Internet Information Services 6.0 may not function correctly after installing KB973917
  
  
  We recommend reviewing the "Prerequisites for Windows Server 2003" section if your computer is not a clean Windows Server 2003 SP2 installation.
  
  As of December 16, 2009, if you use Automatic Updates, you will no longer be offered this update if your IIS installation is in a configuration where both SP1 and SP2 binaries are present on the computer. We recommend that you review the following article in the Microsoft Knowledge Base for the next steps that you must take to make sure that the computer is ready to apply this update.
  2009746 Internet Information Services 6.0 may not function correctly after installing KB973917
  
  
• Windows Server 2003 and Windows Server 2008
  
  This update was re-released on March 9, 2010. This re-released update fully replaces the initial release. If you install the new release, the initial release will be uninstalled and replaced by the new one. Uninstalling the March 9 release of this update will leave the computer without Extended Protection for IIS functionality present.

How to obtain this update

For Windows Server 2003

For Itanium-based versions of Windows Server 2003

For x64-based versions of Windows Server 2003 and for Windows XP x64 edition

For Windows Server 2008

For Itanium-based versions of Windows Server 2008

For x64-based versions of Windows Server 2008

For Windows Vista

For x64-based versions of Windows Vista