Authenticating angular for HTTP requests on MVC4 site using Windows Authentication

Question

I am currently developing a website using AngularJS, and the application is meant to POST and GET data to and from an already running MVC4 application. This MVC4 application is using Windows Authentication.

I can access the MVC4 application directly through my browser and navigate a URL that returns a JSON just fine. For now, I've simply downloaded this JSON manually and built the application with that.

My problem comes when I am requesting the server directly from my AngularJS application. I attempted to get this working on another server using Basic Authentication which worked fine. But now I need it to work with Windows Authentication using the NTLM Authentication.

I looked into building the Type 1 Message and setting it in the authorization header but I was quickly overwhelmed.

I feel like the vast amount of communication required between the server and client, just to authenticate, makes using AngularJS and Windows Authentication (NTLM authentication) unappealing? How should I go about solving this?

Answer 1

This problem ended up solving itself.

To explain how I will need to give a little more insight into the way the project was build and how the problem initially came about.

There are two parts in this project:

1. The application using AngularJS to display the data on client side .
2. The API/Web Service used to get the data from a database.

At the very start; I was developing and testing this application on a local web server while still using the API that was deployed on the domain. Since windows authentication was enabled on the API/Web Service my service in AngularJS could not request this data without authentication. (Obviously)

However, since both of these applications would end up being deployed on the same domain under the same IIS this problem ended up taking care of itself.

Deploying the AngularJS applications on the same domain and IIS as the API meant that authenticating the AngularJS application automatically also authenticated the API. This required no further code since the authentication cookie is automatically handled appropriately.