IIS Behind ALB - Auth Loop

Question

Hello, I'm moving an EC2 instance from Linux/Tomcat to Windows/IIS.  The application hosted on the machine is a 3rd party BI application.  This application has a token authentication where a 'parent' application is whitelisted to create a security token.  Since moving to IIS, I sometimes get an authentication loop.  It may not happen, it may loop twice, it may do an infinite loop.

My load balancer config has not changed, only the target.  The load balancer is doing the SSL.  The load balancer is only pointing to a single server, so I wouldn't expect any sticky session issues, but I do have sticky sessions set to true as my old Linux machines had multiple nodes.  The load balancer has a redirect rule to take HTTP traffic and redirect it to HTTPS.  I've seen some older articles suggesting I need to use the URL rewrite module in IIS and setup all sorts of rules.  With Linux, I didn't have to do anything with Tomcat.

I do see if I remove the redirect rule, the authentication starts at HTTPS, but then I do start get HTTP URLs which don't work with all of the security settings in Chrome these days.

This worked flawlessly on Linux and worked for many years when my app was on prem with SSL setup on IIS itself rather than the load balancer.

I know there are some app/vendor specific things here, but the main question is, is there any magic that needs to happen within IIS to correctly work behind the ALB?

Below is an example of what I see in the IIS logs.  AGain, sometimes it may not do this loop and other times is 2, 5, 10+.
```
2025-08-20 15:57:16 10.10.20.125 GET /mysite/getSecurityToken.aspx Username=someuser&Roles=myRoles&RealName=JohnDoe 80 - 10.10.21.125 rest-client/2.1.0+(linux+x86_64)+ruby/3.4.4p34 - 200 0 0 3
2025-08-20 15:57:16 10.10.20.125 GET /mysite myTokenKey=de864504f17347efb461abb1b869670d 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 https://secure2.mbctestweb.com/ 301 0 0 2
2025-08-20 15:57:16 10.10.20.125 GET /mysite/ myTokenKey=de864504f17347efb461abb1b869670d 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 - 302 0 0 2
2025-08-20 15:57:20 10.10.20.125 GET /mysite/rdPage.aspx myTokenKey=de864504f17347efb461abb1b869670d 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 - 200 0 64 3393
2025-08-20 15:57:20 10.10.20.125 GET /mysite/ myTokenKey=de864504f17347efb461abb1b869670d 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 - 302 0 0 503
2025-08-20 15:57:20 10.10.20.125 GET /mysite/rdPage.aspx myTokenKey=de864504f17347efb461abb1b869670d 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 - 200 0 0 21
2025-08-20 15:57:20 10.10.20.125 GET /favicon.ico - 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 https://mysite.com/mysite/rdPage.aspx?myTokenKey=de864504f17347efb461abb1b869670d 404 0 2 1
2025-08-20 15:57:20 10.10.20.125 GET /mysite/getSecurityToken.aspx Username=someuser&Roles=myRoles&RealName=JohnDoe 80 - 10.10.21.125 rest-client/2.1.0+(linux+x86_64)+ruby/3.4.4p34 - 200 0 0 2
2025-08-20 15:57:20 10.10.20.125 GET /mysite myTokenKey=428c466285a0469fa79469adcab87167 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 https://mysite.com/ 301 0 0 1
2025-08-20 15:57:20 10.10.20.125 GET /mysite/ myTokenKey=428c466285a0469fa79469adcab87167 80 - 10.10.21.150 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36 - 302 0 0 12
```

re:Post Agent · Answer

When running IIS behind an Application Load Balancer (ALB) that handles SSL termination, there are a few key considerations that might be causing your authentication loop:

1. **X-Forwarded Headers**: The ALB needs to pass the original client information to your IIS server. Make sure your ALB is configured to forward the X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers. IIS needs these headers to understand that the original request came via HTTPS, even though it's receiving HTTP traffic from the ALB.

2. **URL Rewrite Module**: Unlike Tomcat, IIS often requires the URL Rewrite module to properly handle SSL-offloaded scenarios. This module helps IIS understand that the original request was HTTPS even though it's receiving HTTP from the ALB. You may need to install this module and configure it to respect the X-Forwarded-Proto header.

3. **Application-Specific Configuration**: Your authentication loop could be happening because the application is detecting that it's receiving HTTP traffic (from the ALB to IIS) and is trying to redirect to HTTPS, creating a loop. This is common when applications have built-in security redirects.

4. **Cookie Settings**: Even though you only have one target, check if your application's cookies are being set with the Secure flag. If they are, but IIS thinks it's serving HTTP content, browsers won't accept these cookies, potentially causing authentication issues.

For IIS specifically, you might need to:
- Install the URL Rewrite module
- Create a rewrite rule that sets HTTPS server variable to "on" when X-Forwarded-Proto is "https"
- Ensure your application is configured to trust proxy headers

This configuration allows IIS to properly understand it's behind an SSL-terminating load balancer, which is likely why your Linux/Tomcat setup worked without additional configuration (as Tomcat often handles this scenario more gracefully by default).  
**Sources**  
[AWS Application Load Balancer, sticky sessions, and failover | AWS re:Post](https://repost.aws/questions/QUcTDEvGA9SzyUXzF96KWK-w/aws-application-load-balancer-sticky-sessions-and-failover)  
[How do I set up SSL to my ec2 instance via a load balancer? | AWS re:Post](https://repost.aws/questions/QUgVOIN7pMTsCQfZgnHtjmrA/how-do-i-set-up-ssl-to-my-ec2-instance-via-a-load-balancer)  
[ALB Node SSL Connection Failure - One of Two Nodes Returns SSL_ERROR_SYSCALL in eu-central-1 | AWS re:Post](https://repost.aws/questions/QUSiXwVGkZQ4ussNBV9JPrdQ/alb-node-ssl-connection-failure-one-of-two-nodes-returns-ssl-error-syscall-in-eu-central-1)

IIS Behind ALB - Auth Loop

Add your answer

Relevant content