Why can't i find reverse web proxy for windows, that accepts Kerberos from client and proxies request with claims to backend non-windows webserver?

Viewed 20

The main idea:

  • I have windows application (maybe IIS site, maybe standalone) that natively accepts Kerberos authentication and impersonates user.
  • Kerberos token sent by client to app already has information about user's groups SIDs, user's SID, etc.
  • On each request, from HttpContext.Current.User I get information about user's groups' SIDs, user SID, translate it to 'plaintext' and pass to non-windows backend (as header, for example).
  • Backend (which can not do kerberos) can read claims added by App from proxied request and send answer, which will be passed to app and then to user (backend->app->user)

Well, what's wrong with this concept?

Why I can not find any existing apps that can work similar way?

The only thing I found is FASTCGI\CGI, which sets REMOTE_USER variable, but this is not enough - frontend had Kerberos with huge amount of data which is dropped by the way to backend.

0 Answers
Related