窗口身份验证时如何控制登录对话框？

Question

the workflow as below

1. I set the application with webapi in IIS as window authentication
2. using ajax to access this webapi,
3. popup the login dialogue (window system dialogue), I think the request to IIS with anonymous, then respond 401 error to the client, the browser popup dialogue.
4. I enter correct domain account, it passes IIS window authentication

5. The request goes to web API, I expand "AuthorizationFilterAttribute" to validate if it has a specified role. but this account has not.

   a. if I respond it also as 401 status. the result is that the login dialogue popup again and again. But the expectation is dialogue disappear and go to an error page.
   b.if I respond it 200 status with an error message to the client. I cannot make the dialogue popup again. I guess it caused by header "Persistent-Auth:true"

I search it from the internet and get the below information.

The browser pops up a login prompt when both of the following conditions are met:

HTTP status is 4xx WWW-Authenticate header is present in the response

So, I try to remove "WWW-Authenticate", but never success. As long as I set

"StatusCode = System.Net.HttpStatusCode.Unauthorized" for "HttpResponseMessage", the client browser always gets "WWW-Authenticate". It seems the window authentication module in IIS covers the information.

//responseMessage.Content.Headers.Remove("WWW-Authenticate"); //responseMessage.Content.Headers.Remove("Persistent-Auth");

So, my question is that

how to remove "WWW-Authenticate" or "Persistent-Auth"? OR

how to pop up login dialogue when the status is 200? Thanks.

Joey

Answer 1

Actually I did it like you mentioned as below.

HttpResponseMessage responseMessage = new HttpResponseMessage()
{
      Content = new StringContent(JsonConvert.SerializeObject(message)),
      //StatusCode = System.Net.HttpStatusCode.Forbidden
      StatusCode = System.Net.HttpStatusCode.Unauthorized
};

But there is a bad user practice. When it response Unauthorized to client. The login dialog would flash once, and login dialog appears again.

The Expected is that enter user account and password and clicking OK button, then server side response Unauthorized to client. Then login dialog disappears and show error page to tell user has not permission. Click login button to show login dialog again.

The above is the question 1.

The question 2, if I use "Forbidden" instead of Unauthorized, then I could implement the above expected, but login dialog would be no longer show again.

The question 3, if I enter the incorrect account or password, then it response statuscode as 0, and the login dialog also cannot show again. Even I press f5 to refresh it. Unless I close chrome and open it again.

Well, window authentication is not easy to use.

Thanks.