Co-hosting RSA and .Net Application on the same IIS Server 10

[WillWilkinson]

we are installing the RSA Web Agent 5.0 SP4 on IIS 10. Along with RSA, we have the application also deployed on the same IIS Server with different port number. The reverse proxy is used to route the traffic between Agent and Application. Now the issue is, the RSA is protecting any request to the server, even the unprotected ones from the application which is running in different port as well. This is causing the application to route in loop, and erroring too many redirects. Is there any setting we need to change to fix or is this the expected behaviour?

[IanStaines]

The word "protecting" is ambiguous when describing how the RSA IIS Web Agent works.

The RSA Agent module will of course be executed for all virtual hosts where it is installed.  So it will be invoked for authentication or authorization for any requests served by this server.  That is by design.  The agent does not care what port is in use.  

In light of this what do you mean by unprotected in this statement?   

even the unprotected ones

[WillWilkinson]

Thank you Ian for the response, there was a misconfiguration which caused the authentication triggered again (which I though unprotected, but protected by url_exclusion_list) which I corrected and make it work.

Is there any reason why the POST form submission is not checked by RSA agent to validate the user and password and re-directing to the launch page with POST submission? What is the significance of ct-iis-form-query?

From the RSA Agent Log:

1607454673.836:[ct_auth_module.cpp/1835]:<Debug>:[[OnSendResponse]]:Checking for logon header
1607454673.836:[ct_auth_module.cpp/2762]:<Massive>:[get_response_header]:...
1607454673.836:[ct_auth_module.cpp/2762]:<Massive>:[get_response_header]:...
1607454673.836:[ct_auth_module.cpp/2783]:<Debug>:[get_response_header]:Header ct-iis-form-query is NULL\n
1607454673.836:[ct_auth_module.cpp/2086]:<Massive>:[Destructor]:...
1607454673.836:[ct_auth_module.cpp/2090]:<Debug>:[Destructor]:free Heap
1607454673.836:[ct_request_data.c/291]:<Massive>:[ct_destroy_request_data_from_id]:...

[IanStaines]

All requests are checked by the agent. 

I am not sure what you mean by "Launch page" this is not an RSA term.

The ct-iis-form-query is unique to the IIS agent and it is used to identify requests made to the logon page and ensure the POST data is handled correctly.   Its a required to work around some deficiencies in the way IIS handles requests.   

[IanStaines]

Any further questions or can I mark this thread as answered?

[WillWilkinson]

Thanks Ian, as you see from the agent log, the ct-iis-form-query value is null, the app is not authenticated and it is re-directing to the login form page. Is there any specific settings to be done to make the IIS agent to work properly or if you can share any specific documentation for this, that would be helpful.

[IanStaines · Accepted solution]

Sorry from your description I cannot confirm your assertion that the RSA Access Manager Agent is not working correctly. 

The documentation for the agent is available here:

https://community.rsa.com/docs/DOC-79284