--- title: "ISAPI" slug: "isapi-1" description: "using ISAPI Filter for SSO with MFA and RapidIdentity" tags: ["ISAPI Filter", "Administrator", "SSO", "MFA"] updated: 2023-05-31T17:15:45Z published: 2023-05-31T17:15:45Z canonical: "help.rapididentity.com/isapi-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt > Use this file to discover all available pages before exploring further. # ISAPI Filter Configurations ## ISAPI Filter Configurations for SSO ### Overview ISAPI filters are DLL files that can be used to modify and enhance the functionality provided by IIS. ISAPI filters always run on an IIS server, filtering every request until they find one they need to process. The ability to examine and modify both incoming and outgoing streams of data make ISAPI filters powerful and flexible. A filter listens to all requests to the site on which it is installed. There are some internal sites at organizations that require basic auth credentials for authentication. With an ISAPI Filter, once a User is logged into RapidIdentity, credentials can be automatically passed to these internal sites to enable SSO. Previously, the Enboard product provided this functionality through an ISAPI filter that lived in the on-prem IIS web server that handles redirection to the intended application after an authentication event. The proposed solution presented here will emulate that behavior with RapidIdentity as the SSO agent, replacing the Enboard system. **Prerequisites** - **Required .NET 6.0 framework or higher**. - **Required Internet Information Services (IIS) with ISAPI Filters module, Basic Authentication**. - **RapidIdentity User should sync with Active Directory(AD)**. - **Configure Service Identity Key with Authentication API Consumer role on RapidIdentity**. 1. **Install .NET 6.0 framework or higher** Download & Install through this link [.NET 6.0 framework (x64)](https://dotnet.microsoft.com/en-us/download/visual-studio-sdks) on the windows server. 2. **Install Internet Information Services (IIS) with ISAPI Filters module enabled.** - On the taskbar, click on the **Server Manager**. - In **Server Manager**, click the **Manage** menu, and then click on the **Add Roles and Features**. - In the **Add Roles and Features** wizard, click on the Next. Select the installation type and click Next. Select the destination server and click on the **Next**. - On the **Server Roles** page, expand **Web Server (IIS)**, expand **Web Server**, expand **Application Development**, and then select **ISAPI Filters**. ![image1.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image1.png) - On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Security, and then select **Basic Authentication**. Click Next. ![image2.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image2.png) - On the **Select features** page, click on the **Next**. - On the **Confirm installation selections** page, click on the **Install**. - On the **Results** page, click on the **Close**. - Enable **Basic Authentication** & Disable **Anonymous Authentication** - Press Win+R and type inetmgr. On **IIS Server**> **Sites**> Double Click on **Default Web Site** > Double Click **Authentication** ![image3.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image3.png) - Right Click on **Basic Authentication** and then click on the **Enable**. - Right Click on **Anonymous Authentication** and then click on the **Disable**. ![image4.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image4.png) 1. **To sync RapidIdentity User with Active Directory(AD) follow [Sync Idaas tenant user with Active Directory](https://help.rapididentity.com/preview/v1/en/17fda651-fba3-46c6-9b4e-237b8a8cf6d1/1) steps.** 2. Service Identity must exists and it should have key with **Authentication API Consumer role** as shown in below screenshot. ![RI-1.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/RI-1.png) - For configuring secret key for ISAPI a user must login with Grant Support Access. - Secret key must be active. **Configuration steps:** Step 1 : Go to **Configuration** >> **General** >> **Settings** >> **Authentication** module. Step 2 : For ISAPI select Service Identities and Secret Keys which will be used for ISAPI requests, as shown in below screenshot. ![RI-2.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/RI-2.png) **ISAPI Filter Installation Steps** 1. Login to the Server machine as Administrator user, locate the Windows IDAutoAuthFilter installer. 2. Right click on the installer file and Click on the **install**. ![image5.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image5.png) 1. Click on the **Next** button. ![image6.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image6.png) 2. Select Single or multiple websites from the left panel on which we need to enable **ISAPI filter** as below and click on the **Next** button. ![image7.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image7.png) Now selected website(s) will be shown on right panel then click on the **Next** button. ![image8.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image8.png) 1. Enter **Cookie Domain**, **Tenant Name** and **API Key** and click on the **Next** button. ![1.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/1.png) - **Cookie Domain**: Enter Cookie Domain Name - **Tenant Name**: Enter Tenant Name - **API Key**: Enter Tenant Secret API Key 1. Click on the **Next** button ![image10.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image10.png) 2. Now Click on the **Install** button ![image11.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image11.png) 3. Now Click on the **Finish** button and Installer window will be closed. ![image12.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image12.png) 4. Open **Control panel**> **Programs**> Uninstall a program **ISAPI Filter** will be shown as **IDAutoAuthFilter for Windows**. ![image13.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image13.png) 5. Open **Server Manager**> **Tools** > **Internet Information Services** (IIS) Manager. Alternatively Press Win+R and type inetmgr. ![image14.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image14.png) 6. On **IIS Server**> **Sites**> Double Click on **Default Web Site** > Double Click ISAPI Filters ![image15.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image15.png) 7. ISAPI Filter will be shown as **IDAutoFilter** and it is configured. ![image16.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image16.png) 8. To change the **Secret API Key**, Follow the steps given below. - Open **Installer Location** Example: C:\Program Files\Identity Automation\IDAutoAuthFilter for Windows. - Double Click on **IA.KeyProtect** - Click **Yes**. ![image17.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image17.png) 1. Enter **Secret API Key** and Click on the **Save** button. ![image18.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image18.png) 2. Click on the **OK** button. ![image19.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image19.png) 3. To change the **Cookie Expiration Time**, Follow the steps given below. - Press **Win+R** and type **regedit** then click on the **OK** button. - Open Computer>HKEY_LOCAL_MACHINE>SOFTWARE>Identity Automation>InstalledProducts>IDAutoAuthFilter for Windows - Double Click on **CookieExpirationTime** ![image20.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image20.png) - Change value data to updated value then click on the **Ok** button. ![image21.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image21.png) 1. To change the **Tenant Name**, Follow the steps given below. - Press **Win+R** and type **regedit** then click on the **OK** button. - Open Computer > HKEY_LOCAL_MACHINE > SOFTWARE >Identity Automation>InstalledProducts>IDAutoAuthFilter for Windows - Double Click on **RapidIdentityUrl** ![3.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/3.png) - Change value data to updated value then click on the **Ok** button. ![4.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/4.png) **ISAPI Filter Silent Installation** 1. Open command prompt as Administrator user. 2. And run the below command. 3. **msiexec.exe /i "Path:\ IDAutoAuthFilter for Windows.msi" /quiet /passive DOMAIN= SERVER_URL= APIKEY= SELECTED_WEBSITES=** Example for Single Website: msiexec.exe /i "C:\IDAutoAuthFilter for Windows.msi" /quiet /passive DOMAIN="domain.com" SERVER_URL="https://example.com" APIKEY="$s5******Q=$" SELECTED_WEBSITES="Default Web Site" Example for Multiple Website: msiexec.exe /i "C:\IDAutoAuthFilter for Windows.msi" /quiet /passive DOMAIN="domain.com" SERVER_URL="https://example.com" APIKEY="$s5******Q=$" SELECTED_WEBSITES="Website1,Website2" **ISAPI Filter Uninstallation Steps** ``` Note: The Configured ISAPI Filter will be deleted on selected websites when application is uninstalled. Ensure that logged into the workstation as an Administrative account with permissions to install/uninstall applications. ``` Open **Control panel**> **Programs**> **Uninstall a program** Right click on IDAutoAuthFilter for windows and click **Uninstall**. ![image22.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image22.png) **ISAPI Filter Upgradation Steps** 1. Login to the **Server machine** as Administrator user, locate the Windows IDAutoAuthFilter installer. 2. Right click on the installer file and click on the **Install**. ![image23.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image23%281%29.png) 3. Click on the **Next** button ![image24.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image24.png) 4. Click on the **Next** button. ![image25.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image25.png) 5. Click on the **Next** button. ![1.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/1%282%29.png) 6. Click on the **Next** button. ![image27.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image27.png) 7. Now click on the **Install** button. ![image28.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image28.png) 8. Now click on the **Finish** button and Installer window will be closed. ![image29.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image29.png) 9. Open **Control panel**> **Programs**> **Uninstall a program** ISAPI Filter will be shown as **IDAutoAuthFilter for Windows**. ![image30.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image30.png) **ISAPI Filter Silent Upgrade** 1. Open command prompt as Administrator User. 2. The Run the below command. 3. **msiexec.exe /i "Path:\IDAutoAuthFilter for Windows.msi" /quiet /passive** Example msiexec.exe /i "C:\IDAutoAuthFilter for Windows.msi" /quiet /passive