I had a site hosted in IIS 7.5 with the Classic pipeline. I had set the authentication for that site so that Windows and Forms authentication were enabled, but anonymous was not. This caused the user to be prompted the first time they came to the site for the Windows authentication. Then it would bring them to the site as normal. This was set up for a review site for our client to be able to exclusively access that site without anyone accidentally stumbling upon it.
I just updated that site and moved it over to the Integrated pipeline. Now, when you first go to the site, it still prompts for the Windows authentication, but then it brings you to the loginUrl specified in the web.config for the forms authentication, which is not what I want.
From what I understand about the 2 pipelines' affects on authentication, I believe it is the issue. Is there any way I can replicate the behavior I was originally getting in Classic mode now that I've switched to Integrated mode?
Related
I have migrated a asp.net web site from IIS6 to IIS8.5. Almost all issues are fixed. But it seems that the identity of the user gets lost.
Related questions I found:
Cannot get authentication working in IIS 8.5
Configure windows Authentication in IIS 8.5 on Windows Server 2012
Receiving login prompt using integrated windows authentication
When I open the webpage from the server IE browser there is no login prompt (which would be fine if the integrated authentication was used)
When I open the webpage from a remote client I should get a login prompt for authentication (since the user on the client does not exist on the server). But there is none.
On the old platform IE6 was used. On the new platform IE is used with compatibility mode
In the old web page integrated windows authentication (only) is enabled and working.
In the new web page on IIS 8.5 I tried all kind of settings but none seem to do the trick.
Found out that actually the authentication itself is working.
This link was very helpful finding this out:
https://forums.asp.net/t/1179997.aspx?Get+Username+for+logged+in+user
But the user name gets lost in a different way. I will close this question and post another one.
I have the following requirement: if a user in domain 2 goes into an ASP.NET site that is in domain 1, then the site should display a customised login form to validate the user. But if a user from domain 1 surfs to same the ASP.NET site (on domain 1), then Windows authentication (using Active Directory) takes place, so the user should goes straight through to the site content without seeing the login form.
How would I go about doing that?
Would I first need to detect the request domains? I have tried HttpContext.Current.Request in Page_Load() but have not yet been successful in detecting which domain a request is from.
Also, how should I setup the site authentication mode? Would I need Windows authentication for domain 1 users, and forms authentication for domain 2 users? I have also not been able to succeed in this, since IIS 7.5 complains that I cannot have both Windows and Forms authentication turned on.
Thanks.
Surely not an answer but due to the length, I am adding it as answer not comment.
AFAIK, IIS 7.5 allows both authentications to be enabled but no through web.config, you have to do it through IIS Management console, furthermore the scenario you described is handled through claims authentication (windows for intranet and forms for extranet) in Sharepoint 2010. I think same approach can be used in ASP.NET application since Sharepoint is also built on top of ASP.NET 3.5. More over you can look into Federated Authentication APIs present in .Net. You can explore the following links Claims Aware ASP.NET Applications and Federated Authentication and Enabling Federated Authentication for ASp.NET in Azure. Hope this helps.
Goal
I am trying to deploy an MVC3 application that requires Windows Authentication (specifically Kerberos) as an Application within an older asp.net Anonymous Authentication Website.
Symptoms
In IIS 7.5 Express on my box it works perfect, obviously. When I deploy it to IIS 7.5 as its own site I get challenged for domain credentials, though none are accepted. When I deploy it as an application I get the custom error page back from the hosting site. To confirm - Kerbtray shows no ticket in either scenario.
Details
Both the Site and the new child Apps run on the same application pool, and the application pool runs as AppPoolIdentity. That built-in IIS app pool account (IIS AppPool\MyAppPoolName) has full Read/Execute permissions down both the Site's and the App's folder trees. No impersonation is used.
Question(s)
Is there anything special I need to do to get NTLM and Kerberos working on an App inside an anonymous auth Site?
If not, any advice on things/places to look would be great - the ApplicationHost.config and the app's web.config files look fine.
EDIT: For clarification, this is all on a corporate network that uses Kerberos extensively for other purposes. "Site" refers to an IIS Website and is distinguished from an "Application" that must be hosted within an IIS Site.
After working on this a bit more, I found the answer:
Nothing special is needed to host a Windows (Kerberos) authenticated IIS App within an Anonymous authenticated IIS Site on IIS 7.5 so long as:
a. Kernel Mode Authentication is On - No SPNs required.
b. The application uses the same App Pool Identity as the hosting parent. Different App Pools and their identities can be used, but this does require further NTFS permissions and is beyond the scope of this particular issue.
The issue with my error was something much more simple yet elusive... the parent Site had a custom set of error pages defined in <HttpErrors> including pages for 401 and 403.
This was the error page returned when the user requested a page from the nested Application because Kerberos sends a 401 first, to challenge the user for credentials and ask/him her to get and provide a Kerberos ticket... but because the parent Site returned a 200 response (the custom error page) the user never got a Kerberos ticket.
With these off, the user is now appropriately getting a Kerberos ticket and falls back to NTLM as by default.
Anyone experience any issues with IIS7, integrated mode forms authentication while using IE8? I have a website with a login form, once logged in, any postback causes the user to be logged out. This doesn't even happen consistently, sometimes I can login and not experience this issue, other times it happens instantly. I can not replicate the problem in any other browser and I cannot replicate on my development machine running / debugging vs2010.
Is your application on a server farm? If so, ensure your web.config's have matching machine keys - http://msdn.microsoft.com/en-us/library/w8h3skw9(v=VS.100).aspx
Can you please post a small explanation of the prerequisites of using Windows Authentication?
I know that you have to turn Windows Authentication on from web.config or IIS and define domain.
Does the web server have to be connected to the Active Directory server or not, and how to get user info from Active Directory like name and description?
You don't have to be on a domain. The local server user accounts can be used with windows authentication. If the machine is on a domain, then either AD users OR local users can be used with windows authentication.
The minimum that has to be in place to use windows authentication in asp.net is that IIS has to have Windows Authentication enabled for the web site. IIS can still have other authentications enabled for the site too, even anonymous authentication can be used in conjunction with windows auth... as long as windows authentication is enabled also asp.net can use it.
Otherwise, your question is too broad for a good answer here. Authentication in asp.net is a very big topic; and when you add AD to the mix it gets bigger. I recommend checking out the MSDN documentation, reading through it, experimenting with it, then coming back here with more specific questions.