Windows 身份验证不适用于具有 ASP.NET 核心的 IIS

Question

I am trying to use Windows Authentication for ASP.NET Core MVC application. Following is the problem statement.

When application is run with IISExpress, it runs without any issues. But when it is configured as a site in IIS and run, it prompts for credentials and even after entering corrected credentials application shows error page with status 401.

Details: Application is a plain boiler plate ASP.NET Core MVC application with Windows Authentication enabled. I am experimenting to find a solution to use in the actual application.

Framework: .NET Core 2.2

Environment: Visual Studio 2019 on Windows Server 2019 machine with IIS 10.0

Following are the changes I made in the boiler plate application. Changes in Startup.cs file to use authentication.

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        services.Configure<IISOptions>(options =>
        {
            options.AutomaticAuthentication = true;
        });

        services.AddAuthentication(IISDefaults.AuthenticationScheme);

        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}

Added following line of code in Configure method in Startup.cs file.

app.UseAuthentication();

Enabled windows authentication for debug in Project Properties and configured IIS hosting with OutProcess hosting model.

Configured application as a website in IIS with Windows Authentication enabled.

Things I have tried.

1. Tried adding forwardWindowsAuthToken="true" in web.config file.
2. Tried adding the site in Local Intr.net sites in Inte.net options of browser.
3. Tried using UseIIS() in Program.cs for WebHostBuilder.

Suggestions from StackOverflow questions I tried.

Asp.Net core MVC application Windows Authentication in IIS

ASP.Net Core: keep windows authentication

Asp.Net Core Windows Authentication Not Working in IIS

If I enabled Windows Authentication on both IIS and on Application, the application prompts for credentials when browsed. Even after entering current credentials it does not go thru and re-prompts. After attempting 3 times the application shows error page with 401 error.

I believe configurations are correct if I application is prompting for credentials, but I am fail to understand why it is not accepting the user login even after providing corrected credentials.

Note: All the activities, development, debugging, hosting etc are happening on the same Windows 2019 server machine. And the machine is hosting a domain controller too and login is attempted with one of the valid domain users.

I am completely clueless right now and anything I try results in the same issue at the end. Feel free to ask if any more details required.

EDIT 1 ----------------------------------------------

I got little success with configuring my site on IIS with port 8081 and with not binding name.

This way when I browse http://localhost:8081 it logs the current user in without any problem. But when I configure it with any binding name such as sample.localapp.com it starts prompting for credentials but never accept it.

Thanks in advance.

Answer 1

I was having this same issue on Windows 10. The solution turned out to be detailed in first comment on the question described here

1. Open RegEdit
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. Right-click MSV1_0 and create a new multi-string value called BackConnectionHostNames
4. Double click BackConnectionHostNames and enter the DNS name of your local site.
5. Reboot your computer.

Answer 2

Please add IIS_IUSRS to the publish folder or where your web application located

Answer 3

Hello friend I know you put the answer in the question but I try to elaborate more:

Delete your binding name in c:\windows\system32\drivers\etc\host file and in IIS manager goes to your website right click it and choose Edit Bindings... option, edit your binding website clearing the Host Name: field, and you now can write in the browser url http://servername:port/