I have an aspx site that I'm working on for our company's intranet. I recently added some secure pages that require the user to be a member of particular groups in an Active Directory in order to view. We are using Windows Authentication for the site(I have windows authentication in the .config). Windows Authentication is enabled in the IIS, and Anonymous Authentication is disabled. I've also enabled NTLM Authentication in the projects properties.
As far as I can tell, the security stuff is working as expected. Only users with the proper credentials can access the secure pages (I'm securing them with the [Authenticate Roles = "bla"] check on the controller action).
The problem I'm having is not really a problem, but more of an annoyance. Whenever the user logs in to the site, they are prompted with a login dialog. I don't want this. I want the site to grab their credentials from the windows login and use that to determine their access rights. I was under the impression that Windows Authentication handled this on its own, but it appears I was wrong.
Basically, how can I get rid of the login prompt and have Windows Authentication handle all of that same functionality automatically?
Is there some server setting I might need to change? Could it be something in my code?
I want it to work with at least IE, Firefox, and Chrome, if that is at all possible.
***Update 7/23/2012
Thanks everyone for the suggestions, unfortunately I still haven't gotten this to work properly. Some things I've noticed that may help provide some more details
I'm fairly certain the intranet site is on our list of "trusted" sites (our network admin says it is).
I'm using NTLM authentication and NTLM authentication only. If I remove NTLM authentication and enable Negotiate: Kerberos authentication, I just get a 401 - Unauthorized error. I can fix this by disabling Kernel mode authentication, but then I still get the credentials prompt(which I don't want).
If I check "Enable Integrated Windows Authentication*" in IE > Internet Options > Advanced > Security, it will prompt me for credentials, but entering my credentials no longer works. It will ask me three times and then take me to the 401 error page.
IE9 asks me only for my password and pulls my username(good). Chrome and Firefox prompt me for username and password.
Look in Internet Explorer / Tools / Options / Advanced.
There is a checkbox "Enable Integrated Windows Authentication" under "Security".
Is this checked?
It's checked by default, and can be set by admins using a GPO:
http://www.windowsecurity.com/articles/configuring-advanced-ie-settings-using-group-policy.html
There is a setting within IE that allows this automatic pass through to happen. Your system administrator could create a group policy and push this to all users.
I've also been successful in configuring Firefox to function in the same matter but that would involve modifying individual users FF configurations.
This line should be in your web.config within the <system.web> element.
<authentication mode="Windows" />
Just thought I'd provide an update as to what actually solved the problem.
I tried all of the great suggestions you guys provided for internet explorer settings, but in the end, it turned out to be a server setting.
Flipping the order of Providers for the site to NTLM, Negotiate in that order solved the problem.
Related
I am implementing a C# MVC 4 application hosted in IIS 7.5 to replace the company intranet. The requirement is that when a user is at their personal workstation logged in with their windows credentials they will not be prompted to login(this is not optional the customer is firm on this as they believe this is how SharePoint works. Though I cannot confirm), however when they are on a mobile device or on a personal computer off the local network they will be promoted for their credentials. Also, while off the network the user should be able to log out, and the application should log out automatically after a period of inactivity. All users who have access to the application will have AD credentials.
I attempted to get a working solution with windows authentication, but it is my understanding that windows authentication is not intended for use outside a local network. Even if I could get the desired authentication results with this option there is no ability to log out without a significant amount of kludge and hacking with JS.
It appears that by default forms authentication is the answer, but is there a way to utilize the users windows credentials and authenticate against active directory with those without prompting the user to login while on the network?
Unfortunately even after I called Microsoft I was unable to find a good work around for this issue. They did suggest Active Directory Federation Service. This was not an option for us.
There is also a great blog post that does the opposite of what I am looking for but could probably be manipulated to work.
After working with my product owner we settled on a true forms authentication model. The way I was able to appease them was for users on the local network I am setting the time out for the forms authentication token and cookie to a longer duration and refreshing the duration so that if users are active on the application often enough they may never be prompted to log in.
This may not be the most elegant solution, but it has allowed us to meet the requirements set by the product owner. If anyone has additional suggestions I would love to hear them.
I'm continuing someone else's development AND I don't know much about current practices for authentication in MVC applications.
The only things that are set about authentication are in the application's IIS configuration:
.NET Authrization Rules = Allow, All Users
Authentication:
Anonymous Authentication: Enabled
ASP .NET Impersonation: Disabled
Windows Authentication: Enabled
With this configuration, on the server, the browser asks me for a login/password. I enter my network login.
Then I can get identify the user with Request.RequestContext.HttpContext.User.Identity...
On local computer where I login using the same login/password: no user is logged in the application (Request.RequestContext.HttpContext.User.Identity.Name == ""). If I disable Anonymous Authentication, the browser simply keeps re-asking for loginpassword infinitely.
My first problem is that I would like to be able to log out on server.
From scarse info I got here and there I have already tried:
FormsAuthentication.SignOut(); --> does nothing
WebMatrix.WebData.WebSecurity.Logout(); --> Exception, tries to access a database (I got this from one of the VS2012 templates but I didn't think it would apply to my context).
if(this.Request.RequestContext.HttpContext.Session != null)
this.Request.RequestContext.HttpContext.Session.Clear(); --> Session is null, so this does nothing.
So, how can I log out in order to relog as a different user ?
(I would also like to be able to identify the user on local computer, but I think that should be asked in another topic.)
Removed FormsAuth logout method as the question is for Windows Auth... doh!
Update:
To get the logged in user name try the IPrincipal Controller.User:
User.Identity.Name
Doh my bad your using Windows Authentication...
In which case it's the browser that is caching the credentials not the server / IIS so clearing the session won't achieve anything.
Taken from here:
"The user credentials are being cached by the client browser, not by IIS. To
force the client user to enter credentials again, you would need to send an
appropriate 401 status message in response to the next client request.
However, doing this would run counter to very legitimate user expectations
of how Windows authentication is supposed to work, so you may want to
reconsider. When Windows user credentials have already been accepted by a
server (either via a login dialog or automatic submission under IE
configuration for the target site or zone), a 401 is only expected if a
requested resource cannot be accessed under the previously supplied
credentials. When you send a 401 after any credentials have been previously
accepted, the user should expect that they need to use different credentials
from their initial login. If you're expecting the same credentials, then
user confusion should be anticipated.
All in all, if you really want to force a new login, perhaps a different
authentication mode might be more appropriate."
For an IE only workaround see this SO post.
I have created a asp.net web application and have used windows authentication, for testing purposes i want to use the application as a different user.
I thought running firefox as a different user would achieve this but doing this does not seem to work. The HttpContext.Current.User property is still logged in AD user.
Is there a setting or anything i need to change in firefox to fix this?
There is an very easy option for every program. Use RUNAS command. Open cmd and type:
runas /user:DOMAIN\USER "c:\Program Files (x86)\Mozilla Firefox\firefox.exe"
I think you can configure the "Integrated windows authentication" in fireFox in the about:config page.
Please take a look at the following link. This link is to activate the integrated authentication but maybe you can use it to do the revert operation.
Once FireFox ask you for username and password you will be able to enter a different from yours (logged one).
I don't know to much about firefox, but there is a setting under IE properties (which I think most other browsers derive security settings from). "Automatic login for intranet sites" - or something to that effect, needs to be turned off and it should then start to prompt you for login details.
Is it possible to grab a users windows credentials (i.e. username) without having windows authentication enabled in IIS? With windows auth disabled the code below returns either NT AUTHORITY or IIS APPPOOL\ASP.NET v4.0 depending on if impersonation and anonymous authentication are enabled or not.
System.Security.Principal.WindowsIdentity.GetCurrent().Name.ToString();
I am converting an asp.net web application that is using forms authentication to custom authentication. Basically if a user is connecting from outside the network I force a credential check whereas if they are connecting from within the network I would like to be able to just grab their windows username. The internal portion works when I turn on windows authentication but I get the popup login box when testing outside of the network. I either need to disable windows authentication for non local connections or figure out how to get the windows username with windows authentication disabled. Any suggestions? (The other alternative i thought of was splitting the application in two and having separate authentication modes for each but I'd like to avoid this).
-I have also tried:
System.Web.HttpContext.Current.User.Identity.ToString();
System.Threading.Thread.CurrentPrincipal.ToString();
something like this is actually (kind of) possible using Active Directory Federated Services. In the event of a windows user from inside the network they can be configured to use their account details. For external users, they can be redirected to a page that will require them to log in.
However. This is very heavy-duty and an extreme pain in the..neck to implement and is really only applicable to enterprise solutions that have the resourses to use this kind of solution. Otherwise, I'd say go with the 2 site approach.
Simple answer is no.
Best solution is to create 2 sites. One for internal users that user windows authentication, one for external user that user forms authentication but authenticate against AD. You can make users always go to external site by default and then redirect based on their IP. That is redirect intranet users to internal user.
I have a WebAPI application that expects to use Forms authenticaiton, or my own custom Basic or Digest authentication. It works fine on most servers. But on a few servers it does not work.
I have found that when the authentication fails it is because IIS has authenticated the App Pool user. Thread.CurrentPrincipal.Identity.AuthenticationType = "Negotiate". AFAIK this is windows authentication. However windows authentication has been disabled for the site in question, and I even went so far as uninstalling the windows authentication feature on the server and still experienced the same problem.
I have found that setting runAllManagedModulesForAllRequests to true will resolve this problem, though it is not a desirable work around as it adds overhead to all requests even those that run through the static handler.
If anyone can tell me why this is happening, or how to debug the authentication process on IIS it would be very helpful.
Edit: IIS7/7.5 Integrated Pipeline if it makes a difference
While experiencing the similar issue, here is my observation and suggestion.
The issue could be related to the Anonymous user account which is used as Anonymous user identity. The default setting could be the problem. Please, read here more details:
IIS documentation
IIS tips
Summary:
Using IIS 7.0 UI, go to Authentication page and select Anonymous Authentication. Then on the right click Edit and select the user to be used for this. If this (newly selected) user has access to all static files, all should start working. Selecting App Pool Identity will grant the access rights specified for current pool user account.
The default value is IUSR, which is more detailed described here:
Missing IUSR account on Windows Server 2008 R2 / IIS7.5