• Illustration: New IIS Management Console

A new version of Internet Information Services (IIS) aims to make Windows a more attractive platform for Web hosters and developers using Apache by providing a more modular architecture, improving the performance of PHP applications, and offering better management tools, particularly for servers that host large numbers of Web applications. IIS 7 is in beta now and will ship with Windows Server 2008, which is expected to be available in early 2008. A special license is also available that allows customers to use the beta in a production environment, albeit with no formal product support.

Development Platform

For developers, IIS 7 contains two particular features that could help build higher-performance Web applications—improved performance for PHP (a server-side scripting language for building Web applications that is particularly widely used with Apache) and a caching system to allow previously processed pages to be reused.

Making PHP Faster

Although IIS has always supported PHP, because of the way PHP communicated with it, IIS did not perform as fast as Apache running on Linux.

PHP interfaces with Web servers via the Common Gateway Interface (CGI), a standard protocol supported by all Web servers. CGI allows a Web server to hand off the processing of Web requests to an external application. The Web server is configured to associate certain sites or file extensions with a given application, and each time a request is received for that site or extension, the Web server launches the application, waits for it to terminate, and returns the results back to the browser.

On Windows, launching a new process has significantly more overhead than it does on Linux, putting Windows at a performance disadvantage when running PHP applications. To make up for this shortcoming, IIS has for years included the Internet Services API (ISAPI), an alternative to CGI that runs external applications as a DLL. Even though the core PHP engine is available in an ISAPI implementation, many popular third-party PHP libraries do not work in that configuration.

IIS 7 includes FastCGI, a new implementation of CGI that maintains compatibility with the large number of third-party PHP modules but eliminates the performance penalty associated with running PHP on Windows. Rather than launching a new OS process for each request, FastCGI maintains a pool of processes to handle CGI requests. When a request is received, an already running process is selected to handle the request. When it is done, the process doesn't terminate, but is instead reset and placed back in the pool. FastCGI thereby avoids the overhead of launching and terminating an OS process for each request, making PHP and other CGI applications perform much better than with previous versions of IIS.

IIS 7 further speeds up Web applications with the option to cache the output of certain requests. Output caching is particularly useful for PHP (or other CGI-based applications) because it means that a request can be handled without performing any processing at all. In addition, the IIS 7 cache is kernel-based, further improving the response time for cached requests. (ASP.NET already has its own output-caching mechanism but can benefit from IIS's kernel-based cache.) The cache can be configured to store only certain types of requests, or certain URLs and entries can be set to expire after a specified amount of time.

Managing and Configuring Large Servers

IIS 7 includes a number of changes designed to make the product more appealing to Web hosters and other customers who need to run very large numbers of Web sites on a single server.

Metabase: R.I.P.

The metabase, a global store used in previous versions of IIS to hold configuration information, has been removed. The metabase was notorious for getting corrupted and was difficult to replicate across multiple servers used in Web farms. IIS 6 replaced the proprietary binary format with an XML format, but the centralized nature of the metabase still made IIS more difficult for Web hosters than Apache.

In IIS 7, instead of having a central repository for the configuration information of all applications, IIS 7 uses a hierarchy of configuration files; general IIS settings are stored in a global XML file (named ApplicationHost.config) but each Web application is now configured through a separate XML file (named Web.config) stored in the application's own directory.

Having distinct configuration files for each application provides several benefits. Applications are easier to move from machine to machine because their configuration information can be directly copied along with their other files. This new system also allows Web hosters to delegate application management to the owner of a specific site without having to give them access to the full metabase, which could compromise performance and security.

Besides the standard set of configuration options, developers can store their own configuration information in the Web.config file and have the option of encrypting selected information. Developers can use a number of APIs to read and write the configuration information, including a new set of .NET APIs. (The older metabase APIs are also still supported as an optional installation but now read and write the Web.config files.)

New Management Console

Microsoft has overhauled the IIS management console to make it easier to use and provide better support for large numbers of applications and sites per server.

Previous versions of IIS used a console based on the Microsoft Management Console (MMC), but IIS 7 joins the increasing number of Microsoft servers bypassing MMC in favor of their own custom management consoles. The new IIS console is a Windows Forms application written using the .NET Framework. Although the console can be hosted within MMC, its user interface (UI) is completely different than traditional MMC snap-ins. For example, MMC-based consoles typically group tasks into property pages—modal dialog boxes sometimes containing 10 or more tabs and which can be very difficult to navigate. IIS 7 streamlines the UI by grouping tasks by features and taking better advantage of screen real estate. (For an illustration of the new console, see "New IIS Management Console".)

In particular, the new UI provides better support for servers running many applications: administrators can now search for a particular application and go directly to that application's configuration settings. Previous versions required the administrator to expand a node in a tree view to display all applications and then scroll through the list to locate the specific application. This process works well when there are a small number of applications on the server, but if there are thousands of applications, even expanding the tree view to display the list of applications can take a considerable amount of time.

In addition to providing a new graphical console, IIS 7 is configurable by PowerShell. Both the new UI console and the PowerShell support are layered on top of the Web.config files.

More Modular

IIS 7 has been rebuilt to provide a more modular architecture—administrators can add and remove individual components as necessary. Examples of modules that can be controlled include support for CGI, ISAPI, and various authentication modules, such as forms, Windows, and anonymous authentication.

Removing unneeded components can help with server maintenance, by eliminating the need to install patches for components that are not in use, and also reduces the potential attack surface, making the system less vulnerable to data theft as well as viruses and other malicious software.

The modular architecture also helps IIS support Windows Server Core Mode, a special installation option for Windows Server 2008 that allows IT administrators to install the minimal set of files necessary to support a given server role, such as an Active Directory domain controller, a file and printer server, and, with IIS 7, a Web server.

In Beta, but Available for Deployment

As has been the case with previous versions, even though IIS 7 is in beta, it can be deployed in a production environment through a "Go Live" license.

The license allows the product to be used in production, but with limitations—for example, there is no formal support program and customers must install any security or bug fixes produced by Microsoft in a "commercially reasonable" amount of time. The Go Live license expires on Apr. 8, 2008, which should be well after the final release of IIS 7 and Windows Server 2008 and give customers enough time to migrate to the final version.

Resources

The IIS 7 Beta and Go Live license are available at www.iis.net/default.aspx?tabid=79 and www.iis.net/goLive, respectively.

IIS 7 support for Windows Server Core Mode is described in "Web Servers on Windows Server Core" on page 23 of the July 2007 Update.

A white paper describing FastCGI is at www.fastcgi.com/#Docs.