Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to support NTLM authentication with fall-back to form in ASP.NET MVC?

Tags:

How can I implement following in ASP.NET MVC application:

  1. user opens intranet website
  2. user is silently authenticated if possible
  3. if NTLM authentication didn't worked out, show login form to user
  4. user indicate login password and select domain from list of predefined domains
  5. user is authenticated in code using AD

I know how to implement 4 and 5 but cannot find info on how to combine NTLM and forms. So that NTLM native login/password dialog is never shown - transparent authentication or nice looking login page.

How should work? Should user be asked login and password? Can her current credentials (domain username) be used without asking to enter login and password?

UPDATE for these, investigating same problem:

When I was asking this I was not fully understand how NTLM authentication works internally. Important thing here to understand is that if user's browser doesn't support NTLM properly or if NTLM support is disabled by user - server will never get chance to work around this.

How Windows authentication is working:

  1. Client send a regular HTTP request to server
  2. Server responds with HTTP status 401 and indication that NTLM authentication must be used to access resources
  3. Client send NTLM Type1 message
  4. Server responds with NTLM Type2 message with challenge
  5. Client send Type3 message with response to challenge
  6. Server responds with actual content requested

As you see, browser not supporting NTLM will not go to step (3), instead user will be shown IIS generated Error 401 page.

If user doesn’t have credentials, after cancelling NTLM authentication popup dialog window browser will not continue to (3) as well.

So we have no chance to automatically redirect users to custom login page.

The only option here is to have a “gateway” page where we decide if user should support NTLM and if so, redirect to NTLM protected home page.

And if not, show login form and allow authentication by manually entering login and password.

Decision is usually made based on users’ IP address and/or host name either by matching IP ranges or by checking table of predefined IPs.

like image 457
Igor Romanov Avatar asked Oct 26 '10 20:10

Igor Romanov


People also ask

How do I change the authentication type in MVC project?

Selecting your project and hitting F4 for the properties window allows you to change the authentication method.

How do I set up NTLM authentication?

Click down to “Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. Find the policy “Network Security: LAN Manager authentication level”. Right click on this policy and choose “Properties”. Choose “Send NTLMv2 response only/refuse LM & NTLM”.

How do I add Windows Authentication to an existing MVC project?

By default MVC apps use Form Authentication and Simple Membership, so you need to make it "false" to run Windows Authentication. Select the project name in Solution Explorer and then in the Property Explorer, click to enable Windows Authentication.


1 Answers

This article might get you pointed in the right direction. Basically you have two apps in two virtual directories under the same host name. One app uses Forms authentication, one uses Windows. The one using Windows authentication creates a valid form authentication cookie and redirects to the second virtual directory.

ASP.NET Mixed Mode Authentication

like image 174
Pete Nelson Avatar answered Sep 21 '22 17:09

Pete Nelson