Description of the update that implements Extended Protection for Authentication in Internet Information Services (IIS)

• This update will now correctly detect when a computer that is running Windows Server 2003 Service Pack 2 (SP2) is in an installation where IIS 6 contains some Windows Server 2003 Service Pack 1 (SP1) binaries, and will refuse to install and exits with an error code. The versions of update 973917 that were released before this date will successfully install, but they could cause IIS to not restart after installation.
• On a computer that is running Windows Server 2003, this rerelease addresses an issue that could cause excessive amounts of memory to be allocated upon enabling Extended Protection for Authentication.
• On a computer that is running Windows Server 2008, this rerelease addresses an issue that could cause Extended Protection not to function correctly when IIS is configured to use kernel-mode Windows Authentication.

Back to the top | Give Feedback

Configuration

• Channel binding information that is specified through a Channel Binding Token (CBT). This is used primarily for SSL connections.
• Service binding information that is specified through a service principal name (SPN). This is used primarily for connections that do not use SSL or when a connection is established. For example, this might be in a scenario in which SSL is offloaded to another device, such as a proxy server or load-balancer.

Extended Protection Scenarios

• In these scenarios, you could also specify the AllowDotlessSpn flag if your networking environment supports NetBIOS-based SPNs. However, NetBIOS-based SPNs are not secure.
• For the scenarios in which SPN checking will be used, and channel binding token checking will not be used, you should not specify the NoServiceNameCheck flag.
• Default installation of IIS 6.0, IIS 7.0, or IIS 7.5 does not enable or install Windows authentication. Extended Protection is applicable only when Windows authentication is enabled for your Web site or application.

Configuration on IIS 7.0 and 7.5

<windowsAuthentication enabled="false" />

How to enable Extended Protection for Windows authentication for IIS 7.5

1. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. In the Connections pane, expand the server name, expand Sites, and then select the site, application or Web service for which you want to enable Extended Protection for Windows authentication.
3. Scroll to the Security section in the Home pane, and then double-click Authentication.
4. In the Authentication pane, select Windows Authentication.
5. Click Enable in the Actions pane.
6. Click Advanced Settings in the Actions pane.
7. When the Advanced Settings dialog box appears, select one of the following options in the Extended Protection menu:
   • Select Accept if you want to enable extended protection while providing down-level support for clients that do not support extended protection.
   • Select Required if you want to enable extended protection without providing down-level support.
8. Click OK to close the Advanced Settings dialog box.

How to enable Extended Protection for Windows authentication for IIS 7.0

Configuration

Attribute

Child Elements

Configuration Sample

<location path="Default Web Site">
   <system.webServer>
      <security>
         <authentication>
            <windowsAuthentication enabled="true">
               <extendedProtection tokenChecking="Allow" flags="None">
                  <spn name="HTTP/www.contoso.com" />
                  <spn name="HTTP/contoso.com" />
               </extendedProtection>
            </windowsAuthentication>
         </authentication>
      </security>
   </system.webServer>
</location>

Sample Code

AppCmd.exe

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /enabled:"True" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /extendedProtection.tokenChecking:"Allow" /extendedProtection.flags:"None" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/www.contoso.com']" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/contoso.com']" /commit:apphost

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetApplicationHostConfiguration();

         ConfigurationSection windowsAuthenticationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site");
         windowsAuthenticationSection["enabled"] = true;

         ConfigurationElement extendedProtectionElement = windowsAuthenticationSection.GetChildElement("extendedProtection");
         extendedProtectionElement["tokenChecking"] = @"Allow";
         extendedProtectionElement["flags"] = @"None";

         ConfigurationElementCollection extendedProtectionCollection = extendedProtectionElement.GetCollection();

         ConfigurationElement spnElement = extendedProtectionCollection.CreateElement("spn");
         spnElement["name"] = @"HTTP/www.contoso.com";
         extendedProtectionCollection.Add(spnElement);

         ConfigurationElement spnElement1 = extendedProtectionCollection.CreateElement("spn");
         spnElement1["name"] = @"HTTP/contoso.com";
         extendedProtectionCollection.Add(spnElement1);

         serverManager.CommitChanges();
      }
   }
}

Visual Basic .NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration
Module Sample
   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetApplicationHostConfiguration

      Dim windowsAuthenticationSection As ConfigurationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site")
      windowsAuthenticationSection("enabled") = True

      Dim extendedProtectionElement As ConfigurationElement = windowsAuthenticationSection.GetChildElement("extendedProtection")
      extendedProtectionElement("tokenChecking") = "Allow"
      extendedProtectionElement("flags") = "None"

      Dim extendedProtectionCollection As ConfigurationElementCollection = extendedProtectionElement.GetCollection

      Dim spnElement As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement("name") = "HTTP/www.contoso.com"
      extendedProtectionCollection.Add(spnElement)

      Dim spnElement1 As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement1("name") = "HTTP/contoso.com"
      extendedProtectionCollection.Add(spnElement1)

      serverManager.CommitChanges()
   End Sub
End Module

JavaScript

var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST";

var windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site");
windowsAuthenticationSection.Properties.Item("enabled").Value = true;

var extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection");
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow";
extendedProtectionElement.Properties.Item("flags").Value = "None";

var extendedProtectionCollection = extendedProtectionElement.Collection;

var spnElement = extendedProtectionCollection.CreateNewElement("spn");
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com";
extendedProtectionCollection.AddElement(spnElement);

var spnElement1 = extendedProtectionCollection.CreateNewElement("spn");
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com";
extendedProtectionCollection.AddElement(spnElement1);

adminManager.CommitChanges();

VBScript

Set adminManager = createObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST"

Set windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site")
windowsAuthenticationSection.Properties.Item("enabled").Value = True

Set extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection")
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow"
extendedProtectionElement.Properties.Item("flags").Value = "None"

Set extendedProtectionCollection = extendedProtectionElement.Collection

Set spnElement = extendedProtectionCollection.CreateNewElement("spn")
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com"
extendedProtectionCollection.AddElement(spnElement)

Set spnElement1 = extendedProtectionCollection.CreateNewElement("spn")
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com"
extendedProtectionCollection.AddElement(spnElement1)

adminManager.CommitChanges()

Configuration on IIS 6.0

1. Start Registry Editor. To do this, click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W3SVC\Parameters\extendedProtection\
3. Verify that the
   tokenChecking
   ,
   Flags
   , and
   spns
   registry values are present.
   
   If these registry values are not present, follow these steps to create them:
   1. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
   2. Type tokenChecking, and then press ENTER.
   3. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
   4. Type flags, and then press ENTER.
   5. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click MULTI_SZ Value.
   6. Type spns, and then press ENTER.
4. Click to select the tokenChecking registry value.
5. On the Edit menu, click Modify.
6. In the Value data box, type the preferred value, and then click OK.
7. Click to select the flags registry value.
8. In the Value data box, type the preferred value, and then click OK.
9. Click to select the spns registry value.
10. In the Value data box, enter an appropriate spn, and then click OK.
11. Exit Registry Editor.

Back to the top | Give Feedback

Windows XP and Windows Server 2003 file information

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" and "Service branch" columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x64-based versions of Windows Server 2003 and for Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR
  6.0.6002.18xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
  6.0.6002.22xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and Windows Server 2008

For all supported IA-64-based versions of Windows Server 2008