URL rewrite for IWA realms

Version Affected:  All

Description:  

When a realm is setup for IWA (WindowsSSO) users on non-kerberos machines get an NTLM prompt instead of being sent to a Forms realm for a proper login with IWA

Cause:  

When the URL Rewrite is set at the realm level. It kicks in after IWA so the redirect happens too late. 

Instead, set it at the Default website level as outlined below. 

Resolution:  

1. Open IIS Management Studio and navigate to the Default Realm
2. Double Click on URL Rewrite and create a new blank rule

3. For the Pattern, set the regex as follows SecureAuth27(?!\w)  

   This is if your IWA realm is called SecureAuth27 the regex afterwards prevents it matching SecureAuth270 271 etc

   

4. Add a connection based on how you'll redirect. For example, if all your non-IWA machines are on a different IP range, you can use {REMOTE_ADDR} if it is to be based on device type, you can redirect with {HTTP_USER_AGENT}
   
   
    
5. Set the Action Type to redirect
6. Set the Redirect URL to the forms based realm that you'd like to redirect to
7. Check the box to Append query string
8. Set the Redirect Type to Temporary (307)
   
   
    

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.