连接到域后无法访问C＃，对域用户进行身份验证

Question

We have an MVC application that validates windows users by instantiating a principalcontext, locally and for domain users. However, this immediately fails when a connection to the domain cannot be made. Is there a way to leverage the capability of windows to still validate domain credentials when disconnected from the domain?

We see that in SSMS you can also use windows authentication after the server has lost access to the domain.

To be clear, the machine is joined to the domain but does not have access to the domain controller, ie a corporate laptop that is taken home.

Thanks for the help in advance.

Answer 1

The answer is in how Kerberos (and I believe NTLM is similar) works in that they use session tickets . So once authentication is successful against a domain controller, you have a "ticket" that proves you authenticated. When you authenticate to anything else that requires Windows authentication, the ticket is sent.

To take advantage of this, you must use the built-in Windows authentication. You cannot take a username and password and try to authenticate them that way.

If everyone who uses your website can use Windows authentication - then you can enable it for your whole site.

If you have a mixed audience - some who have a domain account and some that don't - it's a little trickier, but still doable. I've done it. You can look at the OWIN-MixedAuth project. I haven't used that specifically.

That project seems to use a separate button for the Windows authentication. When I did it, I made it seamless (it tries Windows auth and fails back to a login page). I did that by doing an AJAX request in the background to a page that requires Windows authentication, and if it succeeds, just forward on. If it fails, show the login fields.

All that said, I don't know it will work if the server cannot reach the domain. It will probably work for users who have already authenticated to the site before it lost connection to the domain, or if the site is hosted on the same computer that it is being accessed from. But it might not work if a user it has never seen before tries to login while there is no access to the domain. You will have to test.

But the benefit of using Windows authentication anyway is that you can make the login seamless. As long as the site is in your Trusted Sites (in the Windows Internet Options) then IE and Chrome will automatically send the user's credentials.