How to get a simple CGI app to work in IIS 6.0 -- iis security

mathis
6/27/2007 6:33:58 PM

So I've checked out the various topics here (e.g.
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/bc0c4729-e892-4871-b8f3-fcbf489f2f09.mspx?mfr=true)
but somehow my simple "hello world" cgi app does not execute. All it
does it output simple html. The funny thing is that the app does
execute, but somehow the authentication dialog box ("Connecting
to...") prompting me for userid/password pops up. I type in my
credentials, hit ok, but it just re-prompt me again. In the end I only
get 401.2 (HTTP Error 401.2 - Unauthorized: Access is denied due to
server configuration). So I never see my "Test successful message
(this works on IIS 5.0)

My hello.cpp app is :
#include <stdio.h>
#include <windows.h>
void main()
{
printf("HTTP/1.1 200 OK\r\n");
printf("Content-Type: text/html\r\n");
printf("Transfer-Encoding: chunked\r\n");
printf("\r\n");
printf("\r\n");
printf("<html><head><title></title></head>\r\n");
printf("Test successful 3 </html>\r\n");
OutputDebugString("Test successful \r\n ");
}

Some disclosures.
- running locally on my own box using my own credentials
- windows integrated authentication enabled.
- execute permission enabled on the directory in IIS
- I can browse static content from that directory.
- I set up a "web service extension" for hello.exe
- NTFS permission should not be an issue (since the app actually
completes execution as indicated by OutputDebugString)
- This works on IIS 5.0
- believe my response header is correct and properly terminated.

What am I missing here?

Log file:
2007-06-28 01:23:45 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
- 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT
+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) - mathiss06
401 2 2148074254 1849 264 0
2007-06-28 01:23:45 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
SEA\mathiss 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE
+7.0;+Windows+NT+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR
+3.0.04506.30) - mathiss06 200 0 64 0 4679 15
2007-06-28 01:23:45 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
- 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT
+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) - mathiss06
401 1 0 1929 4679 0
2007-06-28 01:23:47 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
- 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT
+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) - mathiss06
401 2 2148074254 1849 264 0
2007-06-28 01:23:47 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
SEA\mathiss 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE
+7.0;+Windows+NT+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR
+3.0.04506.30) - mathiss06 200 0 64 0 4679 0
2007-06-28 01:23:47 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
- 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT
+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) - mathiss06
401 1 0 1929 4679 0
2007-06-28 01:23:48 W3SVC1 MATHISS06 172.30.80.104 GET /hello.exe - 80
- 172.30.80.104 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT
+5.2;+WOW64;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) - mathiss06
401 2 2148074254 1849 264 0

David Wang
6/28/2007 12:00:00 AM

Please provide the following information:
- What authentication protocol(s) are enabled on the /
- What exactly do you mean that you can "browse static content from
that directory". Are you saying that you can make an HTTP request to
the server (and how is that request authenticating?) and it succeeds
for a static HTML page?

Best Guesses:
- If it is only Windows Integrated Authentication and you have
disallowed KeepAlives, this can occur.
- IIS has no configuration which allows HTTP request to static content
succeed but CGI fail with 401.2. The client controls the
authentication protocol used for both requests, so it is possible that
the client somehow successfully authenticates for the request to
static content but fail for the CGI. Why? No idea, but it is not a
server issue.

FYI: Your CGI code is actually incorrect. It claims to send out
chunked entity body but fails to actually send it as chunked encoded.
It really does not matter that something "works" on IIS5 -- legacy is
no indication of its correctness.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

[quoted text, click to view]

iis security : How to get a simple CGI app to work in IIS 6.0