# OH3 with Microsoft IIS Reverse Proxy and Authentication

**URL:** <https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774>\
**Category:** Installation\
**Tags:** iis\
**Created:** [December 31, 2022, 3:54pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774 "2022-12-31T15:54:16Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [December 31, 2022, 3:54pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/1 "2022-12-31T15:54:16Z")

</div>

Has anybody gotten a reverse proxy to work with OH being on RPI internally and IIS exposed to the internet?

The IIS reverse proxy is working but I don’t have any authentication pages coming up to actually do anything with OH.

Looks like this is covered well with NGINX below and it seems I need to add two strings to IIS but where?

> [@OH3 with NGINX Reverse Proxy and Authentication](https://community.openhab.org/t/oh3-with-nginx-reverse-proxy-and-authentication/106528/10):
>
> I don’t see any reason it won’t work. Yes it would make sense to add to openHABian.

add\_header Set-Cookie X-OPENHAB-AUTH-HEADER=1;  
proxy\_set\_header Authorization “”;

Best, Jay

---

<div class="post-metadata">

**Author:** ![justaoldman](https://community.openhab.org/letter_avatar_proxy/v4/letter/j/c68b51/32.png) [@justaoldman](https://community.openhab.org/u/justaoldman)\
**Post date:** [January 1, 2023, 5:41am UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/2 "2023-01-01T05:41:42Z")

</div>

Hi Jay,  
those are set in the server variables  
I posted on this with pics here.

> [@OpenHab 3 with IIS Reverse Proxy on Windows Server 2019 setup issue](https://community.openhab.org/t/openhab-3-with-iis-reverse-proxy-on-windows-server-2019-setup-issue/136485/7):
>
> Hi Max, after you change the ARR settings try adding these steps in the inbound rule add this \<set name="RESPONSE\_Set\_Cookie" value="X-OPENHAB-AUTH-HEADER=1" /\> in the server variables add this \<add name="RESPONSE\_Set\_Cookie" /\> In Openhab under your settings and then API security check advanced and then enable Allow basic authentication and save! with those settings and the added steps I have mentioned I think you will get the behavior you want. I have included this full web config a…

What I showed should work regardless of whether you are running on a RPI or docker or nux or windows the internal side can run either secure or not that should be irrelevant assuming your internal IIS NIC is able to resolve your internal FQDN of the Openhab RPI or you configured it with IP as for the IIS exposed to the internet If you are fully sealed it will work the configuration setup I outlined does not care if it is internal or external facing and the IIS setup is pretty much MSFT recommended configuration.

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 1, 2023, 12:51pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/3 "2023-01-01T12:51:17Z")

</div>

I actually have been following this thread 😉

Here’s what I have discovered; the rewrite ADD variables feature/logic will not work with Windows 2012 R2 IIS without unlocking the server config. Here’s how to do it:

“_Most IIS sections are locked by default but you can “unlock” them by setting the attribute overrideModeDefault from “Deny” to “Allow” for the relevant section group by modifying the ApplicationHost.config file located in %windir%\system32\inetsrv\config in Administrator mode_”

Search for allowedServerVariables and change it to Allow.

Another big thing that needs to be documented is - when using a windows user/pass to authenticate for IIS, this user/pass must match OH’s GUI user/pass. If they are different, it will just keep prompting you in circles between IIS and OH.

Best, Jay

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 1, 2023, 8:25pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/4 "2023-01-01T20:25:58Z")

</div>

Hey @justaoldman,

Everything is working now except /habpanel’s

The issue is when you first launch /habpanel it will always ask you what panel you want, local or server. This step is not showing up. It shows the initial black page but the options to switch the panel never comes across so you can never see the panels.

My guess it has to do with the rewrite outbound and matching MIME parameters. I’m guessing it’s missing something (JavaScript, etc.).

```
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^application/json" />	

```

Thoughts?

Best, Jay

---

<div class="post-metadata">

**Author:** ![justaoldman](https://community.openhab.org/letter_avatar_proxy/v4/letter/j/c68b51/32.png) [@justaoldman](https://community.openhab.org/u/justaoldman)\
**Post date:** [January 1, 2023, 8:39pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/5 "2023-01-01T20:39:04Z")

</div>

Hi Jay,  
Did you take a look at that last MSFT article I included? I linked it initially due to some behavior changes that 3.4 brought to the table. But if you read through the write up and go to the 3rd(part 3) MSFT link that the writer mentions I seem to recall it talks about pretty much what you are describing for JavaScript quirkiness and how to address it as well. I did not try all of his extra part 3 stuff but it you may give it a whirl and see if it helps.

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 1, 2023, 8:44pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/6 "2023-01-01T20:44:47Z")

</div>

> [@justaoldman](#):
>
> MSFT article I included

I did read it, but that was around 500 errors. Not getting any errors and I’m running OH 3.2 vs. 3.4.

I’ll keep trying to debug.

Best, Jay

---

<div class="post-metadata">

**Author:** ![justaoldman](https://community.openhab.org/letter_avatar_proxy/v4/letter/j/c68b51/32.png) [@justaoldman](https://community.openhab.org/u/justaoldman)\
**Post date:** [January 1, 2023, 8:47pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/7 "2023-01-01T20:47:16Z")

</div>

This one?

> **[IIS with URL Rewrite as a reverse proxy - part 3 – rewriting the outbound...](https://learn.microsoft.com/en-us/archive/blogs/friis/iis-with-url-rewrite-as-a-reverse-proxy-part-3-rewriting-the-outbound-response-contents)**

It is all about outbound and javascript rewrites not 500 errors The entire 3 part series was all around how to make URL rewrite work not just the 500 errors. 🙂

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 1, 2023, 8:59pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/8 "2023-01-01T20:59:05Z")

</div>

Thank you, I did not see this one. I just tried what it said and it’s still not working. I have added all possible MIME entries below to the outbound rewrite. Guess, I’ll continue to debug.

```
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/(.+)" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^application/json" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/png" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/jpg" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/jpeg" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/javascript" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/gif" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^video/mp4" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^video/mpeg" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/svg+xml" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^image/tiff" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^application/xml" />
                    <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/application-javascript" />	

```

Best, Jay

---

<div class="post-metadata">

**Author:** ![justaoldman](https://community.openhab.org/letter_avatar_proxy/v4/letter/j/c68b51/32.png) [@justaoldman](https://community.openhab.org/u/justaoldman)\
**Post date:** [January 1, 2023, 9:15pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/9 "2023-01-01T21:15:18Z")

</div>

Hi Jay for what its worth I just tossed a simple openhab panel together on my test servers and I do not see the issue you mention…

 ![image](https://community-openhab-org.s3.dualstack.eu-central-1.amazonaws.com/original/3X/2/d/2da1741949c9815208134fb559f0d8bcc507ca3e.png)  
as you can see from the url it is running on fqdn and secure and using IIS reverse proxy. Only difference I have here is it is server 2019 not 2012R2 (really doubt that matters) and I am running on a basic openhab build 3.4 that is running on windows10 separate machine different subnet and also vlan (again not that any of that matters either), I also tested 3.2 before on nux and as a docker and before that 3.1 and it also worked fine as I recall IIS does not care what the other environment is actually as long as it can get responses back.

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 2, 2023, 1:22am UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/10 "2023-01-02T01:22:45Z")

</div>

Thank you for testing this, my situation is a bit different.

- No SSL involved anywhere.
- Using a modified habpanel JAR called org.openhab.binding.habpanelfilter-3.1.0-SNAPSHOT.jar which filters only items I want sent to the panel to increase the loading speed.

If I could just get past choosing the panel (local vs. server) it should work perfectly. It has something to do with the sliding door code that isn’t allowing it through the reverse proxy.

The actual web page source code is completely there, the drawer just isn’t working for some reason.

I actually was trying to see if I could just find the cookie that it needs for that setting but that didn’t pan out (didn’t find it).

Best, Jay

---

<div class="post-metadata">

**Author:** ![jwiseman](https://community.openhab.org/user_avatar/community.openhab.org/jwiseman/32/97501_2.png) [@jwiseman](https://community.openhab.org/u/jwiseman)\
**Post date:** [January 4, 2023, 12:41pm UTC](https://community.openhab.org/t/oh3-with-microsoft-iis-reverse-proxy-and-authentication/142774/12 "2023-01-04T12:41:27Z")

</div>

For those that are running Windows 2012, there is a default cache issue with ARR, OH 3.x reverse proxy and large list of OH items.

Thank you @justaoldman for helping me debug this situation!

Everything worked using @justaoldman screen shot documentation, but I wasn’t seeing items in the admin portal nor was habpanel working. The issue was the Response Buffer Threshold cache setting for ARR, it wasn’t big enough so the REST call for the items was being stopped. Once you fix the items showing up in Admin, habpanel works immediately.

 ![Capture](https://community-openhab-org.s3.dualstack.eu-central-1.amazonaws.com/original/3X/8/7/87dc22966afe05918df468b2d912be5dc06361e5.png)

 ![Capture2](https://community-openhab-org.s3.dualstack.eu-central-1.amazonaws.com/original/3X/7/5/752b7ba8e6c983e818f156d704bd0d184cf53448.png)

Best, Jay