Connect to Windows Authentication for LDAP Authentication Credentials

Question

I have a web portal for employees to update their data. People log in there with Active Directory credentials, and I set an OWIN cookie for authentication. All this is done on the MVC login page, which is not related to Windows authentication in IIS.

Now the company’s browser is Internet Explorer and is configured to automatically log in to other Windows authentication sites without asking for a password. This happens when people use the company’s PC and register with their domain accounts. And if they work from home, a Basic Authentication request requests credentials on these systems.

Now I would like to implement automatic authentication when users register in their Windows accounts from work PCs and are present on the login page if they work from home.

I know about 401 errors and authentication, but I never started with this through ASP.Net. I have seen solutions where the user is redirected to a page where IIS is configured for Windows authentication, but I want this to be done without IIS configuration. I also remember that I saw someone mention a solution where the page loads in the <iframe> , where basic authentication is checked, and if authentication was successful, then redirect the already authenticated user to the destination page.

So, my question boils down to the following: Is there a way to initiate (and end) a 401 call for basic authentication with a specific controller action? And then connect to the Controller.User.Identity property to set the OWIN cookie?

UPD: According to the comments: I want Kerberos (Windows Authentication) to work when users are on the domain network, so they are automatically logged in. But I do not want Windows authentication to occur when users are not on the domain network, instead I want the user login page with the password settings to be reset and logged in (taking into account employee verification).

Answer 1

If I read your question correctly, you can do something like the following ...

1) Create 2 authorization filters: one that uses AD and one that uses BasicAuthentication

2) Place them in the correct order. In your case, if I understood correctly, you want to check AD first. If AD authentication fails, you go to the baseline (which is where you make the 401 call). To make sure that the filters are executed as you need, pay attention to the Order property on the filters: https://msdn.microsoft.com/en-us/library/gg401854%28v=vs.98%29.aspx

3) No matter which filter you get into (AD or BasicAuth), you can set the OWIN cookie there

Hope this helps.