View the http redirect and response message from an external authentication provider using ETW

Recently I had to troubleshoot messages that were being sent from an web application hosted on IIS to an external authentication provider. The logs from the application wasn’t something closer to the metal and wasn’t really providing all the details. I really wanted something like fiddler for the webserver. I could have a ran network traces to troubleshoot the issue but the problem was it wasn’t happening consistently. It was sporadic. I knew there would be ETW traces that would have this information. The IIS web logs don’t capture this information.

Here is a example of the SAML authentication process

500px-SAML

In the application I was working with, IIS was the relying party and the user was to be authenticated with Identity Provider.

I wanted to troubleshoot the “AuthnRequest” and “Auth Resp” from and to the IIS. This can be applied to any external authentication like credit card authentication.

I fired my favorite tool Perfview and captured all the IIS traces along with other defaults. I wasn’t really interested in the .NET Code.

Here is the command line for Perfview to the IIS Providers

[gist https://gist.github.com/naveensrinivasan/86a6d7daac73484ef504]

If for some reason that does not work.  You could always use the additional providers in Perfview and add these providers which are IIS and HTTP providers.

[gist https://gist.github.com/naveensrinivasan/5ac34bdd047d2d80cc44]

I let perfview do its job and then stopped the trace when there was an issue.

Here are the ETW events that capture the SAML Request that was sent from IIS to the IDP

Event Name

  1. IIS_Trace/IISGeneral/GENERAL_RESPONSE_HEADERS
  2. Microsoft-Windows-IIS/EventID(47)
  3. IIS_Trace/IISGeneral/GENERAL_RESPONSE_ENTITY_BUFFER
  4. Microsoft-Windows-IIS/EventID(49)
  5. IIS_Trace/IISGeneral/GENERAL_REQUEST_HEADERS

SamlRequest

Here are the ETW events that capture the SAML Response that was being posted from the IDP to the IIS

  1. IIS_Trace/IISGeneral/GENERAL_REQUEST_ENTITY
  2. Microsoft-Windows-IIS/EventID(51)

samlresponse

With this I was able to troubleshoot message that was being sent and received to the IIS.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s