Mixing Forms and Windows authentication in .Net 4.5

Question

This has been possible up to .Net4.0 and IIS 7.5.

The general idea is that you enable anonymous and forms authentication for your intranet site and in a subdirectory you enable windows authentication together with forms authentication and turn off anonymous. By disabling the forms 401 => 302 redirection with some custom code you will be able to get a hold of the users username and domain.

If you google for a solution all roads seem to lead to this blog/solution: http://mvolo.com/iis-70-twolevel-authentication-with-forms-authentication-and-windows-authentication/

However when upgrading to .net 4.5 and IIS8 it breaks, Always forcing a 302 redirect to the login page and no means of getting a hold of the usernamen.

Has anyone solved this yet?

Solution

I made a MVC 5 solution that makes it look like an external provider, the full source code here:

https://github.com/MohammadYounes/MVC5-MixedAuth

I didn't have the chance to test it on IIS 8, try it and let me know.

Comments

[Fiffe]

Interesting. I am experiencing the opposit. Forms auth trumps win auth, and all requests to a page under win auth is immediately redirected to the forms login page. However, my setup is an IIS8, not 7.5. I was using the IIS win auth to retrieve the users AD username and domain and manually do a forms login. That way I could offer both single sign on and manual logins with a form.

[nothingisnecessary]

I also do that for SSO. If I could configure the system to avoid setting Request.IsAuthenticated=true after windows auth (and before forms auth) I could avoid doing a patch (altering all code that checks Request.IsAuthenticated to use a roll-my-own property instead.) Would you be willing to post your web.config please? I see same behavior in server 2012/iis8 (request is considered authenticated after windows auth success, but before forms auth so 'windows' is the primary auth method from asp.net's point of view instead of forms.. but no luck with config options yet). Thanks for the info.

[kleopatra]

Note that link-only answers are discouraged, SO answers should be the end-point of a search for a solution (vs. yet another stopover of references, which tend to get stale over time). Please consider adding a stand-alone synopsis here, keeping the link as a reference.

[The One]

As I understand the user has to enter their windows username in order to authenticate with Windows, is this right? You can't do it automatically?

[MK.]

@Tuco nope, it's auto login.

[Akmal Salikhov]

What IIS setting should be used?

[MK.]

@AkmalSalikhov see github.com/MohammadYounes/Owin-MixedAuth#iis