Windows Authentication for ASP.NET MVC 4 – how it works, how to test it

by

For IIS 8.5 and MVC 4:

How does Windows Authentication work?

In this mode, User.Identity (as in HttpContext.Current.User.Identity) is populated by the underlying web server. This might be IIS Express in the link from @R Kumar demonstrated, or full blown IIS as in the video by @Thomas Benz.

Specifically, User.Identity is a WindowsIdentity object. E.g. the following cast will work:

WindowsIdentity clientId = (WindowsIdentity)HttpContext.Current.User.Identity;

How do I implement Windows Authentication correctly in the web.config file?

  <system.web>
    <authentication mode="Windows" />
  ...

How do I test if the Windows Authentication really works for my ASP.NET MVC 4 web site? In other words, how do I test it on my local development PC with local IIS (version 8), and on my company real web server with IIS version 7?

First, change the ASP.NET authorization to exclude the current user. E.g. 

  <system.web>
    <authentication mode="Windows" />
    <authorization>
      <allow users="yourdomain\someotheruser" />
      <deny users="*" />
    </authorization>

Second, enable Windows Authentication for your site using IIS Manager. It’s under the ‘Authentication’ feature. And disable anonymous authentication.

Note that older explanation will suggest you make changes under element of your site’s web.config. However, recent IIS implementations prevent this for security reasons.

Three, point your browser at the webpage. The browser should ask you to provide credentials, because the current user is not allowed access to the website. Provide the ones that are authorized for the site, and your MVC code should run.

Four, check the user identity. E.g. 

WindowsIdentity clientId = (WindowsIdentity)HttpContext.Current.User.Identity;

More Related Contents:

  1. How to increase request timeout in IIS?
  2. How do I protect static files with ASP.NET form authentication on IIS 7.5?
  3. What does ‘IISReset’ do?
  4. The configuration section ‘system.web.extensions’ cannot be read because it is missing a section declaration
  5. Routing to a fixed URL in ASP.NET MVC
  6. Can the ViewBag name be the same as the Model property name in a DropDownList?
  7. How to make custom error pages work in ASP.NET MVC 4
  8. IIS AppPoolIdentity and file system write access permissions
  9. Receiving login prompt using integrated windows authentication
  10. IIS 500.19 with 0x80070005 The requested page cannot be accessed because the related configuration data for the page is invalid error
  11. IIS7 Cache-Control
  12. ASP.NET Bundles how to disable minification
  13. WCF on IIS8; *.svc handler mapping doesn’t work
  14. Is it possible to access MVC Views located in another project?
  15. EditorTemplate for DropDownList
  16. Mailbox unavailable. The server response was: 5.7.1 Unable to relay for [email protected] [closed]
  17. Context menu to Add Controller/View missing
  18. The type initializer for ‘System.Data.Entity.Internal.AppConfig’ threw an exception
  19. Login failed for user ‘NT AUTHORITY\NETWORK SERVICE’
  20. Nested ASP.NET ‘application’ within IIS inheriting parent config values?
  21. Hosting ASP.NET in IIS7 gives Access is denied?
  22. Removing/Hiding/Disabling excessive HTTP response headers in Azure/IIS7 without UrlScan
  23. double escape sequence inside a url : The request filtering module is configured to deny a request that contains a double escape sequence
  24. IIS7 – The request filtering module is configured to deny a request that exceeds the request content length
  25. Script not served by static file handler on IIS7.5
  26. ASP.NET MVC4 Bundling with Twitter Bootstrap
  27. aspnet_compiler finding wrong version of System.Web.WebPages 1.0.0.0 instead of 2.0.0.0
  28. All requests to ASP.NET Web API return 404 error
  29. ASP.NET session state and multiple worker processes
  30. IIS AAR – URL Rewrite for reverse proxy – how to send HTTP_HOST

Leave a Comment