Skip Headers
Oracle® Fusion Middleware Administrator's Guide for Oracle Access Management
11g Release 2 (11.1.2)

Part Number E27239-03
Go to Documentation Home
Home
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

25 Configuring the IIS Web Server for 10g Webgates

This chapter summarizes activities that you need to perform to configure 10.1.4 Webgate with a Microsoft Internet Information Server (IIS Web server for Windows environments). Unless explicitly stated, information and steps in this chapter apply equally to 32-bit and 64-bit Webgate installations. Topics include:

25.1 Prerequisites

Ensure that your Oracle Access Management Console is running and get familiar with:

25.2 Webgate Guidelines for IIS Web Servers

ISAPI is an Internet Web server extension that the Webgate that communicates with the IIS Web server. For example, you will need the following package to install the Webgates for IIS:

Oracle_Access_Manager10_1_4_3_0_Win32_ISAPI_Webgate

64-bit Webgate: Oracle_Access_Manager10_1_4_3_0_Win64_ISAPI_Webgate.exe

Updating the IIS Web server configuration file is required when installing Webgates. With IIS Web servers, a configuration update involves updating the Web server directly by adding the ISAPI filter and creating extensions required by Access Manager. A filter listens to all requests to the site on which it is installed. Filters can examine and modify both incoming and outgoing streams of data to enhance IIS functionality. ISAPI extensions are implemented as DLLs that are loaded into a process that is controlled by IIS. Like ASP and HTML pages, IIS uses the virtual location of the DLL file in the file system to map the ISAPI extension into the URL namespace that is served by IIS.

Oracle recommends that you update the IIS Web server configuration file automatically during Webgate installation. Automatic updates may take more than a minute. However, updating the IIS Web server configuration file manually takes longer and could introduce unintended errors.

For more specific guidelines, see:

25.2.1 Guidelines for ISAPI Webgates

General Webgate preparation and installation details apply to ISAPI Webgates. Additionally, this topic provides specific guidelines for ISAPI Webgates installed with an IIS Web server. You can install multiple Webgates with a single IIS Web server instance or you might have a 64-bit Webgate.

Note:

Unless explicitly stated, details apply equally to 32-bit and 64-bit Webgates.

lockdown Mode: Before installing the Webgate, ensure that your IIS Web server is not in lockdown mode. Otherwise things will appear to be working until the server is rebooted and the metabase re-initialized, at which time IIS will disregard activity that occurred after the lockdown.

Permissions: Setting various permissions for the /access directory is required for IIS Webgates only when you are installing on a file system that supports NTFS. For example, suppose you install the ISAPI Webgate in Simple or Cert mode on a Windows 2000 computer running the FAT32 file system. The last installation panel provides instructions for manually setting various permissions that cannot be set on the FAT32 file system. In this case, these instructions may be ignored.

Virtual Hosts: Each IIS Virtual Web server can have it's own Webgate.dll file installed at the virtual level, or can have one Webgate affecting all sites installed at the site level. Either install the Webgate.dll at the site level to control all virtual hosts or install the Webgate.dll for one or all virtual hosts.

postgate.dll: You may also need to install the postgate.dll file at the computer level. The postgate.dll is located in the \Webgate_install_dir, as described in "Installing the Postgate ISAPI Filter". If you perform multiple installations, multiple versions of this file may be created which may cause unusual Access Manager behavior. In this case, you should verify that only one webgate.dll and one postgate.dll exist.

Note:

The postgate.dll is always installed at the site level. If for some reason the Webgate is reinstalled, the postgate.dll is also reinstalled. In this case, ensure that only one copy of the postgate.dll exists at the site level.

Updating Web Server Configuration for Webgate: As with other Webgates, your Web server must be configured to operate with the Webgate. Oracle recommends automatically updating your Web server configuration during installation. However, you can decline the automatic update and instead manually configure your Web server as described in "Registering a 10g Webgate with Access Manager 11g Remotely".

FAT32 file system: You may receive special instructions to perform during Webgate installation. For example: Setting various permissions for the /access directory is required for IIS Webgates only when you are installing on a file system that supports NTFS. The last installation panel provides instructions for manually setting various permissions that cannot be set on the FAT32 file system. In this case, these instructions can be ignored.

SSL and Client Certificate Authentication: On IIS, if you are using client certificate authentication you must enable SSL on the IIS Web server hosting the Webgate before enabling client certificates for Webgate. You must also ensure that various filters are installed in a particular order. In addition, you may need to install the postgate.dll as an ISAPI filter.

Web Server Releases: Web server details in this chapter apply to the stated release. If the release is not stated, you can presume it is IIS v5. Details specific to IIS v6 or IIS v7 are identified.

32-bit versus 64-bit Webgates: Unless explicitly stated, all information applies equally to both 32-bit and 64-bit Webgates.

General Webgate Preparation and Installation Details: Refer to this chapter for IIS-specific guidelines. Refer to Chapter 22 for general preparation and installation details.

Completing and Confirming Webgate Installation: Perform tasks relevant to your ISAPI Webgate and IIS version:

25.2.1.1 Webgates for IIS v7

General guidelines and Webgate installation are usually the same regardless of the IIS release for which you are installing a Webgate. However, there are several specific topics to review when you are installing one or more Webgates for IIS v7:

25.2.1.2 Webgates for IIS v6

General guidelines and Webgate installation are usually the same regardless of the IIS release for which you are installing a Webgate. However, there are several specific topics of interest.

Multiple Webgates with a Single IIS 6 Instance: IIS v6.0 supports hosting multiple Web sites on a single Web server instance and ISAPI Webgate allows you to protect each Web site with a different Webgate.

64-bit IIS v6 Webgate: Perform installation as you do for all others, using instructions available in Chapter 22. If you choose manual Web server configuration during Webgate installation, you can access details in the following path:

Webgate_install_dir\access\oblix\lang\en-us\docs\dotnet_isapi.htm

Following Webgate installation and IIS configuration, perform tasks in "Finishing 64-bit Webgate Installation".

Earlier Release Webgate Installations: Previously Oracle recommended that Webgate be installed in the same physical directory location as Policy Manager. This required a virtual directory named “access” for both Policy Manager and Webgate, which is mapped to the physical location of both Policy Manager and Webgate.

Note:

You can install Webgate 10g (10.1.4.3) for IIS in any location, separate from that of Policy Manager.

If you have an earlier, combined Webgate and Policy Manager installation, you can de-couple the components using the following steps.

To de-couple an earlier Webgate/Policy Manager installation

  1. Uninstall any patches applied to the earlier Webgate and Policy Manager, if any.

  2. Uninstall the earlier Policy Manager and Webgate combination.

  3. Install Policy Manager 10g (10.1.4.3).

  4. In a separate directory location, install Webgate 10g (10.1.4.3)

25.2.1.3 Multiple Webgates with a Single IIS 6 Instance

Unless explicitly stated, details in this topic apply equally to 32-bit and 64-bit Webgates.

IIS v6.0 supports hosting multiple Web sites on a single Web server and ISAPI Webgate allows you to protect each Web site with a different Webgate.

Note:

Previous ISAPI Webgate releases did not support multiple Webgates with a single IIS Web server instance. You either had to install one Webgate for all Web sites at the top level, or protect a single Web site by configuring Webgate at the Web site level.

IIS 6 provides application pools that are used to run virtual servers. You can think of an application pool as a group of one or more URLs that are served by a worker process or a set of worker processes. An application pool is a configuration that links one or more applications to a set of one or more worker processes. Because applications in this pool are separated from other applications by worker process boundaries, an application in one application pool is not affected by problems caused by applications in other application pools. Today, Webgate instances can run in different process spaces.

When you have multiple Web sites on a single IIS v6.0 Web server instance, you need to ensure that user requests reach the correct Web site. To do this, you need to configure a unique identity for each site on the server using at least one of three unique identifiers:

  • Host header name

  • IP address

  • TCP port number

Note:

If you have multiple Web sites on a single server and these are distinguished by IP address and port, multiple Webgates are not required. Starting with release 10.1.4.2.0 virtual hosts on Apache and IIS 6.0 are supported. As a result, a single Webgate on the top level can protect all the Web sites even if the IP addresses are different. This is handled by using different Host Identifiers for each Web site.

You can install multiple Webgates on different Web sites of the same IIS Web server instance. However, several manual steps are required.

25.3 Prerequisite for Installing Webgate for IIS 7

This section provides prerequisites for installing Webgates with IIS v7 Web servers. It includes the following topics:

25.3.1 Prerequisite for Installing Any 10g Webgate for IIS 7

The following procedure applies to 32-bit and 64-bit Webgates equally.

With Webgate for IIS v7 Web Server, you can use Form-based authentication without enabling pass through functionality only when the <add segment="bin"/> entry is not present in the applicationHost.config file. For example, if you have access/oblix/apps/webgate/bin/webgate.dll as an action in the Form-based authentication scheme, ensure that the <add segment="bin"/> entry is not present in the applicationHost.config file. If the entry is present, you must remove it, as described next

To locate and remove the <add segment="bin"/> entry

  1. Go to Windows\System32\inetsrv\config and open the applicationHost.config file.

  2. Search for the <hiddenSegments> module.

  3. Remove the entry <add segment="bin"/> if it is present.

  4. Save the file.

25.3.2 Prerequisite for Installing a 32-bit Webgate for IIS 7

The following procedure applies to 32-bit Webgates only.

The following procedure provides steps to configure a 32-bit Webgate for IIS 7 Web Server to use either Simple or Cert transport security mode. This configuration requires that the IIS 6 Management Compatibility module be installed.

To add the IIS 6 Management Compatibility module for a 32-bit Webgate for IIS 7 and Simple or Cert security

  1. From the State menu, click Administrative Tools, and then click Server Manager.

  2. In the Server Manager tree, expand Roles, and then click Web Server (IIS).

  3. In the Web Server (IIS) pane, Role Services section, click Add Role Services.

  4. On the Select Role Services page of the Add Role Services Wizard, click IIS6 Management Compatibility under Management Tools.

  5. On the Confirm Installation Selections page, click Install.

  6. On the Results page, click Close.

25.4 Updating IIS 7 Web Server Configuration on Windows 2008

You can display these steps when you decline automatic Web server updates during Webgate installation.

To display steps to configure IIS 7 Web server on Windows 2008 for ISAPI Webgates

  1. When installing Webgate, click No when asked if you want the automatic Web server update and:

    1. Read information on a new screen to assist in manually setting up your Web server for the Webgate.

    2. Click the following item in the table that appears perform the steps that are displayed.

    Table 25-1 IIS 7 Webgate Windows Server 2008


    Supported Server OS Microsoft IIS
     

    Windows Server 2008

    ISAPI

     

    ...

    ...


  2. After performing steps to update the IIS 7 Web server on Windows 2008, return to the Webgate installation screen and click Next, as described in the chapter on Webgate installation.

  3. Proceed with "Completing Webgate Installation with IIS".

25.5 Completing Webgate Installation with IIS

Unless explicitly stated, details in this topic apply equally to 32-bit and 64-bit Webgates.

Completing Webgate installation with an IIS Web server, includes the following activities after the installation is complete.

Task overview: Completing IIS Webgate installations includes

  1. Enabling Client Certificate Authentication on the IIS Web Server

  2. Ordering the ISAPI Filters

  3. Enabling Pass-Through Functionality for POST Data

  4. Protecting a Web Site When the Default Site is Not Setup

25.5.1 Enabling Client Certificate Authentication on the IIS Web Server

Unless explicitly stated, details in this topic apply equally to 32-bit and 64-bit Webgates.

If you are using client certificate authentication, you must enable SSL on the IIS Web server. If you select client certificate authentication during setup, you must also add the cert_authn.dll as one of the ISAPI filters.

Note:

The procedures here reflect the sequence for IIS v5. Your environment might be different.

To enable SSL on the IIS Web server

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Information Services.

  2. Expand the local computer to display your Web Sites.

  3. Expand the Default Web Site (or the appropriate Web site), then expand \access\oblix\apps\webgate\bin.

  4. Right click cert_authn.dll and select Properties.

  5. In the Properties panel, select the File Security tab.

  6. In the Secure Communications sub-panel, click Edit.

  7. In the Client Certificate Authentication sub-panel, click Accept Certificates and click OK.

  8. Click OK in the cert_authn.dll Properties panel.

  9. Proceed to the next procedure: "To add cert_authn.dll as an ISAPI filter".

To add cert_authn.dll as an ISAPI filter

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Information Services.

  2. Expand the local computer to display your Web Sites.

  3. Right click the appropriate Web Site to display the Properties panel.

  4. Click the ISAPI Filters tab, then click the Add button to display the Filter Properties panel.

  5. Enter filter name "cert_authn".

  6. Click the Browse button and navigate to the following directory:

    \Webgate_install_dir\access\oblix\apps\webgate\bin

  7. Select cert_authn.dll as the executable.

  8. Click OK on the Filter Properties panel.

  9. Click Apply on the ISAPI Filters panel.

  10. Click OK.

  11. Ensure the filters are listed in the correct order.

25.5.2 Ordering the ISAPI Filters

Unless explicitly stated, details in this topic apply equally to 32-bit and 64-bit Webgates.

It is important to ensure that the Webgate ISAPI filters are included in the right order.

Note:

This task is the same whether you are installing one or more Webgates per IIS Web server instance.

To order the Webgate ISAPI filters

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Information Services.

  2. Expand the local computer to display your Web Sites.

  3. Right-click the Web Site and select Properties.

  4. Click Properties, select ISAPI filters.

  5. Confirm the following .dll files appear.

    For example:

    cert_authn.dll webgate.dll

  6. Add any missing filters, if needed, then select a filter name and use the up and down arrows to arrange the filter order as shown in step 5.

    WARNING:

    Confirm that there is only one webgate.dll and one postgate.dll filter. If you perform multiple Webgate installations on one computer, multiple versions of the postgate.dll file might be created and cause unusual Access Manager behavior.

25.5.3 Enabling Pass-Through Functionality for POST Data

This section describes how the Webgate can be set up in conjunction with IIS 6.0 Worker Process Isolation Mode. It also covers configuration steps required for IIS 6.0 running in IIS 5.0 Isolation Mode.

Note:

This section supersedes information in "Installing Postgate.dll on IIS Web Servers" in the 10g Oracle Access Manager Installation Guide. For the IIS 5.0 Web server, the existing functionality using postgate.dll continues to be supported.

Topics here include:

25.5.3.1 About ISAPI Webgate 10.1.4.2.3

Starting with ISAPI Webgate release 10.1.4.2.3, Access Manager pass-through functionality is supported with IIS 6.0 running in a Worker Process Isolation Mode. ISAPI Webgate 10.1.4.2.3 also operates with IIS 6.0 running in IIS 5.0 Isolation Mode using postgate.dll.

Note:

Oracle recommends using Worker Process Isolation Mode for new or existing implementations. Worker Process Isolation Mode is a default setting for the IIS 6.0 Web server. For the IIS 5.0 Web server, the existing functionality (using postgate.dll) continues to be supported.

This section describes how to set up ISAPI Webgate release 10.1.4.2.3 in conjunction with IIS 6.0 Worker Process Isolation Mode. It also provides configuration steps required for IIS 6.0 running in IIS 5.0 Isolation Mode. This section supersedes information in Section 19-6 (Installing Postgate.dll on IIS Web Servers) of the Oracle Access Manager Installation Guide.

25.5.3.2 About Pass-Through Functionality for POST Data

POST data is required for pass through during a form login on the IIS Web server when using the Webgate extension method (where the Webgate is the action of the form). In other words, if a form authentication scheme on the IIS Web server is configured with the pass-through option, and the target of the login form requires the data posted by the form, the Webgate extension method (where the Webgate DLL is the action of the form) cannot be used. The Webgate filter method (where the action of the form is a protected URL that is not the Webgate DLL) must be used instead, and based on IIS version, the postgate.dll must be installed or configure webgate.dll as ISAPI extension.

IIS 6.0 in Worker Process Isolation Mode: webgate.dll must be configured as an ISAPI filter and also as an ISAPI extension to achieve pass-through functionality. (This does not apply to ISA server integration.) Pass-through functionality is supported with 10.1.4.2.3 and higher ISAPI Webgates. However, you must also set a new user-defined parameter "UseWebGateExtForPassthrough" to true in the Webgate configuration profile in the Access System Console.

IIS 5.0 or IIS6.0 running in IIS 5.0 Isolation Mode: postgate.dll must be configured as an ISAPI filter to achieve the pass-through functionality.

25.5.3.3 Implementing Pass-Through: IIS 6.0 in Worker Process Isolation Mode

The following steps outline this task.

Task overview: Implementing Pass-Through Functionality with IIS 6.0 Web Server in Worker Process Isolation Mode

  1. Install Webgate as described in "Locating and Installing the Latest 10g Webgate for Access Manager 11g".

  2. Set the pass-through parameter as described in "Setting the UseWebGateExtForPassthrough Parameter in the Webgate Profile".

  3. Configure webgate.dll as described in "Configuring webgate.dll as an ISAPI Extension".

25.5.3.3.1 Setting the UseWebGateExtForPassthrough Parameter in the Webgate Profile

You must set the new user-defined parameter, UseWebGateExtForPassthrough, in the Webgate profile to implement pass-through functionality with the IIS 6.0 Web server in Worker Process Isolation Mode. You must set UseWebGateExtForPassthrough to true. If this parameter is set to false, pass-through functionality will not work.

To set the UseWebGateExtForPassthrough Parameter in the Webgate Profile

  1. Launch the Access System Console and click Access System Configuration.

  2. Click AccessGate Configuration.

  3. Enter your search criteria for the Webgate, and then click Go.

  4. In the Search Results table, click a Webgate name.

  5. At the bottom of the Details for AccessGate page, click Modify.

  6. On the Modify AccessGate page, locate the User Defined Parameters section of the page, enter the following parameter, and value, and then click the Add button:

    Parameter: UseWebGateExtForPassthrough

    Value: true

  7. Click the Add button if you want to add more user-defined parameters.

  8. Save to save this new information.

  9. Repeat for each Webgate in your deployment.

  10. Proceed to "Configuring webgate.dll as an ISAPI Extension".

25.5.3.3.2 Configuring webgate.dll as an ISAPI Extension

The webgate.dll is part of the Webgate installation. The following procedure describes how to configure webgate.dll as an ISAPI extension. This task must also be performed to implement pass-through functionality with IIS 6.0 Web Server in Worker Process Isolation Mode.

Note:

You can have multiple webgate.dlls configured at different website levels from the top level Web Sites. In this case, you also need to configure webgate.dll as an ISAPI extension for each website protected by Webgate.

To configure webgate.dll as an ISAPI extension

  1. Go to websites, right click, and select Properties.

  2. In the Properties dialog box, select the Home Directory tab.

  3. Click the Configurations button to open the Application Configurations dialog box.

  4. In Wild Card Application Maps, click the Inset button.

  5. Provide the path to webgate.dll. For example:

    Webgate_install_dir/access/oblix/apps/webgate/bin/webgate.dll
    
  6. Uncheck the "verify that file exists" box.

  7. Confirm and finalize the changes: click OK, then click OK again; click Apply, and then click OK.

  8. Stop the IIS Administration Server from Services and restart the IIS Web server.

25.5.3.4 Implementing Pass-Through with IIS 6.0 Web Server in IIS 5.0 Isolation Mode

The following steps outline this task.

Note:

Skip this task if you are using IIS 6.0 Web server in Worker Process Isolation Mode.

Task overview: Implementing Pass-Through Functionality with IIS 6.0 Web Server in IIS 5.0 Isolation Mode

  1. Install Webgate as described in the Chapter 22, "Registering and Managing 10g Webgates with Access Manager 11g".

  2. Set up IIS 6.0 as described in "Setting Up IIS 6.0 Web Server in IIS 5.0 Isolation Mode".

  3. Install postgate.dll as described in "Installing the Postgate ISAPI Filter""Installing the Postgate ISAPI Filter".

25.5.3.4.1 Setting Up IIS 6.0 Web Server in IIS 5.0 Isolation Mode

The following information is updated for the 10.1.4.2.3 Webgate.

When IIS 6.0 Web server is used, the following steps outline how to set up the WWW Service to run in IIS 5.0 Isolation Mode. This is required by the ISAPI postgate filter.

To set IIS 5.0 isolation on IIS 6 Web servers

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Information Services.

  2. Expand the local computer to display your Web Sites.

  3. Right-click the Web Site and select Properties.

  4. Select the Service tab in the Web Site Properties window.

  5. Check the box beside Run WWW service in IIS 5.0 Isolation Mode.

  6. Click OK.

  7. Proceed with "Installing the Postgate ISAPI Filter".

25.5.3.4.2 Installing the Postgate ISAPI Filter

The following information is updated for the 10.1.4.2.3 Webgate.

For single Webgate installations, you should install the filters in the following order:

  • The ISAPI Webgate filter should be installed after the sspifilt filter and before any others.

  • The postgate filter should be installed before the Webgate filter, only if needed.

  • All other Access Manager filters can be installed at the end.

    Note:

    Before installation (or after uninstallation) the filters must be removed manually. If multiple copies of a filter are installed, this means that they were not manually removed before installing the new filters.

You can have multiple webgate.dlls configured at different levels from the top level Web Sites. However, they share the same postgate.dll. If you perform multiple Webgate installations on one computer, multiple versions of the postgate.dll file can be created which might cause unusual Access Manager behavior. There can only be one postgate.dll configured at the (top) Web Sites level of a computer

Note:

postgate.dll is not supported when you have more than one Webgate installed and configured for a single IIS Web server instance.

The following procedures guide as you install and position the postgate ISAPI filter when you have a single Webgate installed with a single IIS Web server instance.

To install the postgate ISAPI filter

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Information Services.

  2. Expand the local computer to display your Web Sites.

  3. Right-click the Web Site and select Properties.

  4. Select the ISAPI Filters tab in the Web Site Properties window.

  5. Click the Add button to display the Filter Properties panel.

  6. Enter the filter name "postgate".

  7. Click the Browse button and navigate to the following directory:

    \Webgate_install_dir\access\oblix\apps\webgate\bin

  8. Select postgate.dll as the executable.

  9. Click OK on the Filter Properties panel.

  10. Click Apply on the ISAPI Filters panel.

  11. Reposition the postgate ISAPI filter, as follows:

    1. Start the Internet Information Services console, if needed.

    2. Right-click your local computer, then select All Tasks, select Restart IIS.

    3. Select the ISAPI Filters tab on the Properties panel.

    4. Select the postgate filter and move it before Webgate, using the up arrow.

      For example:

      postgate.dll webgate.dll

    5. Restart IIS.

      Note:

      Consider using net stop iisadmin and net start w3svc to help ensure that the Metabase does not become corrupted.

25.5.4 Protecting a Web Site When the Default Site is Not Setup

Unless explicitly stated, this topic applies equally to 32-bit and 64-bit Webgates.

When you install a Webgate on an IIS Web server that does not have the "Default Web Site" configured, the installer does not create "Virtual Directory access", which must be done manually using the following procedure.

To protect a Web site (not the default site)

  1. Start the Internet Information Services console, if needed

  2. Select the name of the Web site to protect.

  3. Right-click the name of the Web site to protect and select New, and then select Virtual Directory in the menu.

  4. Click Next.

  5. Select Alias: access, then click Next.

  6. Directory: Enter the full path to the /access directory, then click Next.

    Webgate_install_dir\access

  7. Select Read, Run Scripts, and Execute, then click Next.

  8. Click Finish.

  9. Restart IIS. For example:


    Select Start, then Run.
    Type net start w3svc.
    Click OK.

25.6 Installing and Configuring Multiple 10g Webgates for a Single IIS 7 Instance

This section describes how to install and configure multiple Webgates for different Web sites on the same IIS 7 Web server instance. Several steps are manual and will differ from those that are performed when you install a single Webgate with a single IIS instance. When installing multiple Webgates for a single IIS instance:

When configuring the impersonation DLL for multiple Webgates, you need to configure a user to act as the operating system.

Task overview: Installing and configuring multiple Webgates for a single IIS 7 instance

  1. Installing Each IIS 7 Webgate in a Multiple Webgate Scenario

  2. Setting the Impersonation DLL for Multiple IIS 7 Webgates

  3. Enabling Client Certification for Multiple IIS 7 Webgates

  4. Configuring IIS 7 Webgates for Pass Through Functionality

  5. Confirming IIS 7 Webgate Installation

  6. Perform the following tasks, which are the same whether you install one or more Webgates per IIS Web server instance:

25.6.1 Installing Each IIS 7 Webgate in a Multiple Webgate Scenario

After installing the ISAPI Webgate, there are several manual steps to perform as described here.

By default, webgate.dll is configured as an ISAPI filter at the host name (top) level. When installing multiple Webgates with a single IIS 7 instance, you need to remove the respective webgate.dll from the top level and configure it for the appropriate individual Web site after each Webgate installation.

To install each Webgate when you will have several with one IIS 7 instance

  1. Install the ISAPI 7 Webgate as described in Chapter 22.

  2. Go to the Web site to protect, and configure webgate.dll as the ISAPI filter using these steps:

    1. Start the Internet Information Services (IIS) Manager: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

    2. Select the hostname from the Connections pane.

    3. From the hostname Home pane, double-click ISAPI Filters, look for any Webgate.dll; if it is present, select it and click Remove from the Action pane.

    4. In the Connection pane, under Sites, click the name of the Web Site for which you want to configure a Webgate filter.

    5. In the Home pane, double-click ISAPI Filters.

    6. In the Actions pane, click Add…

    7. In the Filter name text box of the Add ISAPI Filter dialog box, type "Webgate" as name for the ISAPI filter.

    8. In the Executable box, type the file system path of the Webgate ISAPI filter file or click the ellipsis button (...) to go to the folder that contains the Webgate.dll ISAPI filter file, and then click OK.

      Webgate_install_dir\access\oblix\apps\webgate\bin\webgate.dll
      
  3. Creating a Virtual Directory:

    1. Expand the Sites pane and select the Web Site for which you just configured the ISAPI filter (Webgate.dll).

    2. On the Action pane, click View Virtual Directories and then select Add Virtual Directory.

    3. Specify access in the Alias text box and the physical path to the Webgate access folder of Webgate or click the ellipsis button (...) to go to the "access" folder, and then click OK.

      Webgate_install_dir\access\
      
    4. Save and apply these changes.

  4. Setting permissions to the Virtual Directory:

    1. Select the "access" virtual directory created in Step 3.

    2. From the access Home pane, double click Handler Mappings; from the Action pane, select Edit Feature Permissions….

    3. Check boxes beside Read, Script, and Execute, then click OK.

  5. Setting Directory Permissions for Webgate:

    1. In Explorer, right click the Webgate installation directory Webgate_install_dir\access and select Properties.

    2. Click the Security tab and click the Edit button.

    3. Add user "IUSR", select "Allow" for "Modify".

    4. Add user "IIS_IUSRS", select "Allow" for "Modify".

    5. Add user "NETWORK", select "Allow" for "Modify".

    6. Add user "NETWORK SERVICE", select "Allow" for "Modify".

    7. For group "Administrators" select "Allow" for "Modify".

  6. Webgate in Simple or Cert Mode:

    1. In the file system, locate and right-click the "password.xml" file in Webgate_install_dir\access\oblix\config\password.xml, and select Properties.

    2. Click the Security tab.

    3. Give "Allow" for "Read" rights to users "IUSR", "NETWORK SERVICE", "IIS_WPG", "IIS_IUSRS".

  7. Ensure that there is no webgate.dll in the top level (the hostname level).

  8. Perform the next set of tasks using instructions in the following topics:

    1. "Setting the Impersonation DLL for Multiple IIS 7 Webgates"

    2. "Enabling Client Certification for Multiple IIS 7 Webgates"

  9. Repeat these steps when you install the next Webgate for the IIS instance.

25.6.2 Setting the Impersonation DLL for Multiple IIS 7 Webgates

The client's access token is known as an impersonation token. The impersonation token identifies the client, the client's groups, and the client's privileges. The information in the token is used during access checks when the thread requests access to resources on the client's behalf.

Access Manager authenticates and authorizes the user. The Access Manager IISImpersonationExtension.dll in the wildcard extension behaves like a filter for each request to the Web server. Access Manager designates a special user that does have the right to impersonate another user by configuring it using the impersonation username/password on the AccessGate Configuration page. That designated user must have "act as operating system" rights. DLL impersonates the user authenticated and authorized by Access Manager and generates the impersonation token.

You perform the following steps to set the impersonation DLL for each Webgate that protects a Web site for a single IIS 7 Web server instance. You can do this either immediately after the installation task in the previous topic or all at one time.

Note:

This task must be performed for each Webgate that protects an individual Web site for a single IIS Web server instance.

To add the impersonation DLL to IIS 7 configuration for individual Web sites

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Add "IISImpersonationExtension.dll" as a Wildcard Script Map to the required Web Site:

    1. Expand Sites in the connection pane.

    2. Click the Web Site name to which you want to add IISImpersonationExtension.dll.

    3. Double click Handler Mappings from the selected Web Site's "home" pane.

    4. From the Action pane, click Add Wildcard Script Map.

    5. In the Name text box of the Add Wildcard Script Map dialog box, type "Oracle Impersonation Plugin" as name for the dll.

    6. In the Executable box, type the file system path of the Webgate IISImpersonationExtension.dll or click the ellipsis button (...) to go to the folder that contains IISImpersonationExtension.dll, and then click OK.

      Webgate_install_dir/access/oblix/apps/Webgate/bin/ 
      IISImpersonationExtension.dll
      

      This example shows the default path, where Webgate_install_dir is the file system directory where you have installed this particular Webgate.

  3. Proceed as follows:

25.6.3 Enabling Client Certification for Multiple IIS 7 Webgates

You perform this task to set the enable client certification for each Webgate that protects a Web site for a single IIS 7 Web server instance. You can do this either immediately after the adding the impersonation DLL to an individual Web site or all at one time.

Note:

SSL should be enabled on the Web Site before configuring the client certification for Webgate. Follow these steps after the Web Site is SSL enabled.

If you select client certificate authentication during setup, you must also enable and then add the cert_authn.dll as one of the ISAPI filters in the respective Web site.

To enable cert_authn.dll on the IIS 7 Web server

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Expand Sites in the connection pane.

  3. Expand the Web Site to \access\oblix\apps\webgate\bin.

  4. Right click the "bin" directory and select Switch To Content View.

  5. Right click the "cert_authn.dll".and from the drop down menu, select Switch To Feature View.

  6. From the cert_authn.dll Home pane, double click SSL Settings.

  7. From SSL Settings pane, select Require SSL check-box and select Accept from Client Certificates.

  8. Select Apply from Action pane.

  9. Repeat for each Webgate installed on this host, for which you want to enable client certification.

  10. Restart the IIS 7 Web server.

  11. Proceed to the next task: "To add cert_authn.dll as an ISAPI v7 filter".

To add cert_authn.dll as an ISAPI v7 filter

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Expand Sites in the connection pane.

  3. Click on the Web Site name for which you want to add "cert_authn.dll".

  4. In the Home pane, double-click ISAPI Filters.

  5. In the Actions pane, click Add.

  6. In the Filter name box of the Add ISAPI Filter dialog box, type Oracle Certification Authentication Plugin as name for the ISAPI filter.

  7. In the Executable box, type the file system path of the Webgate cert_authn.dll or click the ellipsis button (...) to go to the folder that contains cert_authn.dll, and then click OK.

    Webgate_install_dir/access/oblix/apps/Webgate/bin/cert_authn.dll 
    

    This example shows the default path, where Webgate_install_dir is the file system directory where you have installed this particular Webgate.

  8. Click View Ordered List from the Action pane and arrange the filters as shown here by using "Move Up" or "Move Down":

    cert_authn.dll
    webgate.dll

  9. Select Apply from Action pane.

  10. Repeat for each Webgate installed on this host, for which you want to enable client certification.

  11. Restart the IIS 7 Web server.

  12. Proceed as needed for your deployment:

25.6.4 Configuring IIS 7 Webgates for Pass Through Functionality

Here you will add Webgate.dll as a Wildcard Script Map to the required Web Site. While configuring Webgate to work with pass through functionality, you must ensure that "Physical Path" of the Web sites on which you are installing Webgates differ. Otherwise, the changes in "Handler Mappings" are reflected in all the Web Sites sharing the same physical path.

Note:

"Physical Path" is the path that is provided at the time of creating the Web Site. To check this path after the creation of the Web Site, , In Action pane click on Basic Settings..., you will be presented with a window showing the physical path of the Web Site.

  • Click the Web Site name.

  • In the Action pane, click Basic Settings.

To configure Webgate for pass through functionality

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Expand Sites in the connection pane.

  3. Click the Web Site name for which you want to enable pass through.

  4. Double click Handler Mappings from the selected Web Site's "home" pane.

  5. From the Action pane, click Add Wildcard Script Map.

  6. In the Name text box of the Add Wildcard Script Map dialog box, type Webgate as name for the ISAPI filter.

  7. In the Executable box, type the file system path of the Webgate ISAPI filter file (Webgate.dll) or click the ellipsis button (...) to go to the folder that contains the Webgate.dll ISAPI filter file, and then click OK.

    Webgate_install_dir/access/oblix/apps/Webgate/bin/Webgate.dll
    
  8. In the Access System Console:

    1. Locate the Web Gate profile and click Modify.

    2. Under User Defined Parameters, enter the following parameter and value:

      UseWebGateExtForPassthrough

      true

    3. Save the profile.

  9. Repeat for each Webgate installed on this host, for which you want to enable pass through.

  10. Restart the IIS 7 Web server.

  11. Proceed to the next task: "Confirming IIS 7 Webgate Installation".

25.6.5 Confirming IIS 7 Webgate Installation

You can use the following procedure to confirm IIS 7 Webgate installation.

To verify IIS 7 Webgate installation

  1. Go to the URL:

    http(s)://hostname:port/access/oblix/apps/webgate/bin/webgate.dll?progid=1
    

    where hostname refers to the name of the computer hosting the Webgate; port refers to the Web server instance port number.

  2. The Webgate diagnostic page should appear.

    • Successful: If the Webgate diagnostic page appears, the Webgate is functioning properly and you can dismiss the page.

    • Unsuccessful: If the Webgate diagnostic page does not open, the Webgate is not functioning properly. In this case, the Webgate should be uninstalled and reinstalled. For more information about removing Access Manager see the OAM Installation Guide Chapter 22, then return to the chapter on installing a Webgate.

25.7 Installing and Configuring Multiple Webgates for a Single IIS 6 Instance

Unless explicitly stated, this topic applies equally to 32-bit and 64-bit Webgates.

This section describes how to install and configure multiple Webgates for different Web sites on same IIS Web server instance. Several steps are manual and will differ from those that are performed when you install a single Webgate with a single IIS instance. When installing multiple Webgates for a single IIS instance:

When configuring the impersonation DLL for multiple Webgates, you need to configure a user to act as the operating system.

There can only be one postgate.dll configured at the (top) Web Sites level of a machine. However, you might have multiple webgate.dlls configured at different levels below the top level Web Sites. If you perform multiple Webgate installations on one machine, multiple versions of the postgate.dll file might be created that can cause unusual Access Manager behavior.

Task overview: Installing and configuring multiple Webgates for a single IIS instance

  1. Installing Each Webgate in a Multiple Webgate Scenario

  2. Setting the Impersonation DLL for Multiple Webgates

  3. Enabling SSL and Client Certification for Multiple Webgates

  4. Perform the following tasks, which are the same whether you install one or more Webgates per IIS Web server instance:

25.7.1 Installing Each Webgate in a Multiple Webgate Scenario

Unless explicitly stated, this topic applies equally to 32-bit and 64-bit Webgates.

After installing the ISAPI Webgate, there are several manual steps to perform as described here.

By default, webgate.dll is configured as an ISAPI filter at the Web sites (top) level. When installing multiple Webgates with a single IIS instance, you need to remove the respective webgate.dll from the top level and configure it for the appropriate individual Web site after each Webgate installation.

Note:

If you perform multiple Webgate installations on one machine, multiple versions of the postgate.dll file might be created which can cause unusual Access Manager behavior. The postgate.dll is not supported in environments where you have multiple Webgates configured with a single IIS v6 web server instance.

To install each Webgate when you will have several with one IIS instance

  1. Install the ISAPI Webgate as described in Chapter 22.

  2. Go to the Web site to protect, and configure webgate.dll as the ISAPI filter using these steps:

    1. Start the Internet Information Services (IIS) Manager: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager

    2. Right click Web Sites, and then click the Properties option.

    3. Click the ISAPI filter tab, look for the path to webgate.dll; if it is present in the filter, then select it and click the Remove button.

    4. Under Web Sites, right-click the name of the Web site to protect, and select the Properties option.

    5. Click the ISAPI filter tab to add the filter DLLs.

    6. Add the following filter to identify the path to the webgate.dll file, and name it "webgate".

      Webgate_install_dir/access/oblix/apps/webgate/bin/webgate.dll
      
    7. Save and apply these changes.

    8. Go to the Directory Security tab.

    9. Confirm that "anonymous access" and "basic authentication" are selected so that Access Manager provides authentication for this Web server.

    10. Save and apply these changes.

  3. Go to Web sites level to protect and create an /access virtual directory that points to the newly installed Webgate_install_dir:

    1. Under Web Sites, right-click the name of the Web site to be protected.

    2. Select New and create a new virtual directory named access that points to the appropriate Webgate_install_dir/access.

    3. Under Access Permissions, check Read, Run Scripts, and Execute.

    4. Save and apply these changes.

  4. In the file system, set directory permissions for Access Manager:

    1. In the file system, locate and right-click Webgate_install_dir\access, and the select Properties.

    2. Click the Security tab.

    3. Add user "IUSR_machine_name" and then select "Allow" for "Modify".

      For example, for a machine_name of Oracle, select IUSR_ORACLE.

    4. Add user "IWAM_machine_name" and then select "Allow" for "Modify"

      For example, for a machine_name Oracle, select IWAM_ORACLE.

    5. Add user "IIS_WPG" and then select "Allow" for "Modify".

    6. Add user "NETWORK SERVICE" and then select "Allow" for "Modify".

    7. For the group "Administrators", select "Allow" for "Modify".

  5. If Webgate has been set up in Simple or Cert mode, perform the follow steps:

    1. In the file system, locate and right-click the "password.xml" file in Webgate_install_dir\access\oblix\config\password.xml.

    2. Click the Security tab.

    3. Give "Allow" for "Read" rights to users "IUSR_machine_name", IWAM_machine_name, "IIS_WPG", and "NETWORK SERVICE".

  6. Add a new Web service extension using the following steps:

    1. Right click Web Service Extensions, and then select Add a new Web service extension....

    2. Add the Extension name Oracle Webgate.

    3. Click Add to add the path to the extension file, and then enter the path to the appropriate webgate.dll.

      Webgate_install_dir\access\access\oblix\apps\webgate\bin\webgate.dll
      
    4. Click OK to save the changes.

    5. Check box beside Set extension status to allowed.

    6. Click OK to save the changes.

  7. Ensure that there is no webgate.dll in the ISAPI filter at the top Web site level (“web sites”).

  8. Perform the next set of tasks using instructions in the following topics:

    1. "Setting the Impersonation DLL for Multiple Webgates"

    2. "Enabling SSL and Client Certification for Multiple Webgates"

  9. Repeat these steps when you install the next Webgate for the IIS instance.

25.7.2 Setting the Impersonation DLL for Multiple Webgates

Unless explicitly stated, this topic applies equally to 32-bit and 64-bit Webgates and IIS v6.

The client's access token is known as an impersonation token. The impersonation token identifies the client, the client's groups, and the client's privileges. The information in the token is used during access checks when the thread requests access to resources on the client's behalf.

The Access System authenticates and authorizes the user. IISImpersonationExtension.dll of Access Manager in the wildcard extension behaves like a filter for each request to the Web server. The Access System designates a special user that does have the right to impersonate another user by configuring it using the impersonation username/password on the AccessGate Configuration page. That designated user must have "act as operating system" rights. DLL impersonates the user authenticated and authorized by Access Manager and generates the impersonation token.

You perform the following steps to set the impersonation DLL for each Webgate that protects a Web site for a single IIS Web server instance. You can do this either immediately after the installation task in the previous topic or all at one time.

Note:

This task must be performed for each Webgate that protects an individual Web site for a single IIS Web server instance.

To add the impersonation DLL to IIS configuration for individual Web sites

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Click the plus icon (+) beside the Local Computer icon in the left pane to display your Web Sites.

  3. Click Web Service Extensions in the left pane.

  4. Double-click Webgate in the right pane to open the Properties panel.

  5. Click the Required Files tab.

  6. Click Add.

  7. In the Path to file text box, type the full path to IISImpersonationExtension.dll, and then click OK. For example:

    Webgate_install_dir\access\oblix\apps\webgate\bin\IISImpersonationExtension.dll
    

    This example shows the default path, where Webgate_install_dir is the file system directory where you have installed this particular Webgate.

  8. Verify that the Allow button beside the Webgate icon is grayed out, which indicates that the dll is allowed to run as a Web service extension.

  9. Right click the Web site name, and then click Properties.

  10. Click the Home Directory tab, and then click the Configuration button.

  11. In the list box for Wildcard application maps, click the entry for IISImpersonationExtension.dll to highlight it, then click Edit.

  12. Ensure that the box is unchecked, and then click OK.

  13. Repeat these steps for each Webgate and Web site pair for the IIS Web server instance.

  14. Proceed as follows:

25.7.3 Enabling SSL and Client Certification for Multiple Webgates

You perform this task to set the enable client certification for each Webgate that protects a Web site for a single IIS Web server instance. You can do this either immediately after the adding the impersonation DLL to an individual Web site or all at one time.

Note:

Procedures in this topic apply equally to 32-bit and 64-bit Webgates, and IIS 6, unless stated otherwise.

If you select client certificate authentication during setup, you must also add the cert_authn.dll as one of the ISAPI filters in the respective Web site.

To enable SSL on the IIS v6 Web server

  1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

  2. Expand the local computer icon to display your Web Sites.

  3. Expand the appropriate individual Web Site, then expand \access\oblix\apps\webgate\bin.

  4. Right click cert_authn.dll and select Properties.

  5. In the Properties panel, select the File Security tab.

  6. In the Secure Communications sub-panel, click Edit.

  7. In the Client Certificate Authentication sub-panel, click Accept Certificates and click OK.

  8. Click OK in the cert_authn.dll Properties panel.

  9. Repeat for each Webgate installed on this host.

  10. Proceed to the next task: "To add cert_authn.dll as an ISAPI filter".

To add cert_authn.dll as an ISAPI filter

  1. Start the Internet Information Services console, if needed.

  2. Expand the local computer to display your Web Sites.

  3. Right click the appropriate Web Site to display the Properties panel.

  4. Click the ISAPI Filters tab, then click the Add button to display the Filter Properties panel.

  5. Enter filter name "cert_authn".

  6. Click the Browse button and navigate to the following directory:

    \Webgate_install_dir\access\oblix\apps\webgate\bin

  7. Select cert_authn.dll as the executable.

  8. Click OK on the Filter Properties panel.

  9. Click Apply on the ISAPI Filters panel.

  10. Click OK.

  11. Repeat for each Webgate installed on this host.

  12. Ensure the filters are listed in the correct order.

  13. Proceed to "Confirming Multiple Webgate Installation".

25.7.4 Confirming Multiple Webgate Installation

This task applies equally to 32-bit and 64-bit Webgates, and IIS v6 Web servers.

If you perform multiple Webgate installations on one machine, multiple versions of the postgate.dll file might be created which can cause unusual Access Manager behavior. the postgate.dll is not supported in environments where you have multiple Webgates configured with a single IIS v6 web server instance.

25.8 Finishing 64-bit Webgate Installation

This section describes how to complete installation of a 64-bit Webgate. You can skip this section if you are installing a 32-bit Webgate. In this case, see instead, "Completing Webgate Installation with IIS".

Before you start tasks here, be sure that you have completed Webgate installation according to information in Chapter 22. You must also have completed Web server configuration updates for this Webgate either automatically during Webgate installation or manually, as described in "Webgates for IIS v6".

Task overview: Finishing installation of a 64-bit Webgate

  1. Perform steps in "Setting Access Permissions, ISAPI filters, and Directory Security Authentication".

  2. Enable client certificates, if desired. See "Setting Client Certificate Authentication".

  3. When finished, you can:

    • Confirm operations as described in "Confirming Webgate Installation on IIS"

    • Implement Windows Impersonation, as described in the Oracle Fusion Middleware Integration Guide for Oracle Access Manager.

25.8.1 Setting Access Permissions, ISAPI filters, and Directory Security Authentication

Unless explicitly stated, this topic applies equally to 32-bit and 64-bit Webgates. It describes setting access permissions for the Web site that you are using as a default.

To set or confirm access Permissions, ISAPI filters, and Directory Security Authentication

  1. Start the Internet Service Manager. For example, from the Start menu click Programs then click Administrative Tools, and click Internet Service Manager.

  2. Expand the local computer by clicking +, in the left panel.

  3. Click to expand the Web Sites tab.

  4. Right-click Default Web Site (or the site you are using as a default), and create a virtual directory as described in "Protecting a Web Site When the Default Site is Not Setup".

  5. Right-click Web Sites in the Internet Information Services tab, click Properties, and perform the following steps:

    1. From the Internet Information Services tab, click the Edit button.

    2. Locate the ISAPI filter tab to confirm (or add) the filter DLLs, as follows:

      Filter: If you updated the IIS Web server configuration file, webgate.dll should be properly located.

      No Filter: Add the webgate.dll filter from Webgate_install_dir\oblix\access\apps\webgate\bin\webgate.dll

    3. Save and apply any changes.

    4. Click the Directory Security tab and confirm that both Anonymous Access and Basic Authentication are selected.

      Selected: Proceed to Step 6.

      Not Selected: Select Anonymous Access and Basic Authentication, then save and apply these changes.

  6. Proceed as follows:

25.8.2 Setting Client Certificate Authentication

This task is optional and should be performed only if you want to use client certificate authentication. In this case, IIS and Webgate must be SSL-enabled.

Information in this topic is a sub set of details in "Enabling Client Certificate Authentication on the IIS Web Server".

To add cert_authn.dll as an ISAPI filter

  1. Start the Internet Information Services console, if needed: Click Start, Programs, Administrative Tools, Internet Service Manager.

  2. Expand the local computer to display your Web Sites.

  3. Right-click the Default Web Site (or the Web site that you use as a default), then expand \access\oblix\apps\webgate\bin.

  4. Right click cert_authn.dll and select Properties, then:

    1. In the Properties panel, select the File Security tab.

    2. In the Secure Communications sub-panel, click Edit.

    3. In the Client Certificate Authentication sub-panel, click Accept Certificates and click OK.

    4. Click OK in the Secure Communications panel.

    5. Click OK in the cert_authn.dll Properties panel.

  5. Click the ISAPI Filters tab, click the Add button to display the Filter Properties panel, and then:

  6. Ensure the filters are listed in the correct order, as described in "Ordering the ISAPI Filters".

  7. Proceed to "Confirming Webgate Installation on IIS".

25.9 Confirming Webgate Installation on IIS

After installing Webgate and updating the IIS Web server configuration file, you can use the Webgate diagnostics to verify the Webgate is properly installed.

Note:

This task is the same for both 32-bit and 64-bit Webgates. It is the same whether you are installing one or more Webgates per IIS Web server instance.

To verify Webgate installation

  1. Go to the URL:

    http(s)://hostname:port/access/oblix/apps/webgate/bin/webgate.dll?progid=1
    

    where hostname refers to the name of the computer hosting the Webgate; port refers to the Web server instance port number.

  2. The Webgate diagnostic page should appear.

    • Successful: If the Webgate diagnostic page appears, the Webgate is functioning properly and you can dismiss the page.

    • Unsuccessful: If the Webgate diagnostic page does not open, the Webgate is not functioning properly. In this case, the Webgate should be uninstalled and reinstalled. For more information about removing Access Manager see "Removing a 10g Webgate from the Access Manager 11g Deployment", in the chapter on installing a 10g Webgate Chapter 22.

25.10 Starting, Stopping, and Restarting the IIS Web Server

When instructed to restart your IIS Web server during Webgate installation or setup, be sure to follow any instructions that appear on the screen. Also, consider using net stop iisadmin and net start w3svc are good ways to stop and start the Web server. The net commands help to ensure that the Metabase does not become corrupted following an installation.

25.11 Removing Web Server Configuration Changes Before Uninstall

The information in this section applies equally to 32-bit and 64-bit Webgates.

Web server configuration changes that occur during installation must be manually reverted after uninstalling the Webgate. For example, the ISAPI transfilter will be installed for IIS Webgate. However, if you uninstall Webgate this is not removed automatically. Also, the created Web service extension and the link to the identity directory will not be removed. This type of information must be removed manually. These are examples of information to remove, not a complete list.

Further, you must remove any changes that you manually made to your Web server configuration file for the Webgate should be removed. For more information about what is added for each component, look elsewhere in this chapter.

To fully remove a Webgate and related filters from IIS, you must do more than simply remove the filters from the list in IIS. IIS retains all of its settings in a metabase file. On Windows 2000 and later, this is an XML file that can be modified by hand. There is also a tool available, MetaEdit, to edit the metabase. MetaEdit looks like Regedit and has a consistency checker and a browser/editor. To fully remove a Webgate from IIS, use MetaEdit to edit the metabase.