title: IIS rewrite rule for basic auth on the querystring
body: <p>I am trying to automatically log in users to an Xwiki install via basic auth. This is because help is stored in the wiki, but we want the retrieval process to be transparent to the user.</p>
  
  <p>We push the user off to a url (via an <code>&lt;a&gt;</code> tag) like:
  <code>http://username:password@xwiki.example.org/xwiki/bin/view/Main?basicauth=1</code></p>
  
  <p>This works fine in every browser except Internet Explorer (see: <code>http://support.microsoft.com/kb/834489</code>. Unfortunately, 80% of our user base uses Internet Explorer and it is not an option to have them type in the credentials manually.</p>
  
  <p>Currently, we have IIS 7.5 sitting in front of Xwiki and proxying all requests to the Tomcat instance on another server. This works fine. To solve my problem, I thought I could use a IIS rewrite rule to turn a url like this:</p>
  
  <p><code>http://xwiki.example.org/xwiki/bin/view/Main?basicauth=1&amp;_username=username&amp;_password=password</code></p>
  
  <p>into this:</p>
  
  <p><code>http://username:password@xwiki.example.org/xwiki/bin/view/Main?basicauth=1&amp;_username=username&amp;_password=password</code></p>
  
  <p>The idea being that IIS would substitute the _username/_password querystring parameters into the URL and pass it off to Tomcat, and Xwiki would ignore the extra parameters.</p>
  
  <p>I have created a URL rewrite rule like:</p>
  
  <pre><code>&lt;rule name="BasicAuthRewrite" enabled="true"&gt;
     &lt;match url="https?://(.+)&amp;amp;?_username=(.+)&amp;amp;_password=(.+)" /&gt;
     &lt;action type="Rewrite" url="http://{R:2}:{R:3}@xwiki.example.org/{R:1}" /&gt;
  &lt;/rule&gt;
  </code></pre>
  
  <p>When I go 'Test pattern' in IIS and supply my url, all the backreferences ({R:x}) match up to the data I want. However, when I visit the URL in my browser, the rewrite rule fails to invoke.</p>
  
  <p>Is there any way I can achieve my desired behaviour?</p>