在IIS中托管OWIN / Katana时如何获得WindowsPrincipal？

Question

I am attempting to run an OWIN/Katana application hosted by IIS with Windows Authentication, but no matter what I do, I only ever seem to get a GenericPrincipal which hasn't been authenticated, rather than the relevant WindowsPrincipal .

My Startup.cs :

public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {
        var config = new HttpConfiguration();
        WebApiConfig.Register(config);
        app.UseWebApi(config);
    }
}

My controller:

public class TestController : ApiController
{
    [Authorize]
    public string Get()
    {
        return "Test";
    }
}

From having looked at the requests and debugging through the code, it appears as if the NTLM authentication happens successfully, but when it reaches WebAPI, the Principal is not authenticated, so it returns a 401, causing IIS to try doing Windows Authentication again.

Web.config fragment:

<system.web>
<authentication mode="Windows" />
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />

Update

It appears the WindowsPrincipal does make it into a dummy Middleware I added, but not into WebApi itself. It looks like Katana is changing the principal at some point in the pipeline.

Answer 1

Try to cast the object:

    using System.Security.Principal;

    public ActionResult Get()
    {
        var identity = this.User.Identity as WindowsIdentity;

         if (identity != null)
        {

            var data = new WindowsUserInformation { 
                          Name = identity.Name, 
                          AccountDomainSid = identity.User.AccountDomainSid.Value, 
                          CreationDate = DateTime.UtcNow 
         };

Tell me if this line is giving you the correct identity and if the data is correct... if it is not, then u have some other problem during the authentication ....

Answer 2

I had this problem, and in my case, it was due to a <authentication mode="None"/> sitting in the Web.config. After I removed that, everything worked great - OWIN returned a WindowsIdentity instead of a GenericIdentity.