title: windows single sign on tomcat through IIS Url rewrite
body: <p>I'm facing a difficult setup where I have to configure single sign on, based on the logged in used on my tomcat application.
  I already took some steps which allow me to login via single sign on directly on my tomcat application by using waffle.</p>
  
  <p>I have 1 server where I have a tomcat running and a IIS running (but this IIS will move to another server in the same domain in the future).
  I have the Tomcat running on port 8205 and the IIS configure to accept url's from authpoc.company.com. IIS does a redirect to localhost:8025 via URL Rewrite. 
  My web.xml from IIS</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
      &lt;system.webServer&gt;
          &lt;rewrite&gt;
              &lt;rules&gt;
                  &lt;rule name="ReverseProxyInboundRule1"&gt;
                      &lt;match url="(.*)" /&gt;
                      &lt;action type="Rewrite" url="http://localhost:8205/{R:1}" /&gt;
                  &lt;/rule&gt;
              &lt;/rules&gt;
          &lt;/rewrite&gt;
      &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p><strong>What works</strong></p>
  
  <ul>
  <li>When opening the application directly on localhost:8205 on the server. I get a nice single sign on based on my domain user.</li>
  <li>When opening the application directly on the ip of the server. 192.168.1.1:8205. I can log in but single sign on does not work anymore. This I don't understand. (edit: solved, this is a setting in Internet explorer, see <a href="https://stackoverflow.com/questions/23675335/sso-waffle-asking-username-and-password">SSO waffle asking username and password</a> for more information)</li>
  </ul>
  
  <p><strong>What doesn't work</strong></p>
  
  <ul>
  <li>When redirecting from IIS, I don't get to login into my tomcat application. I have windows authentication enabled, with Negotiate and NTML enabled (in this sequence).</li>
  </ul>
  
  <p>I read a lot on the internet but I can't find anyone with this particular setup. I don't really have the impression I'm doing something exotic.
  One possiblity is that I should connect IIS via AJP instead of a much simpeler URL rewrite.</p>
  
  <p>any help is welcome! Thanks</p>