Windows 授权适用于 IIS Express 上的调试，但不适用于 IIS 服务器

Question

I have been fighting what seems to be a configuration error or a bug in ASP.Net Core 3.1. I am attempting to take in a Windows Authentication user and check if this user is in an AD group that has been specified in the appsettings.json. While in the debug mode locally running IIS Express everything works correctly. The user is authenticated, and the check for the AD group succeeds.

I publish this project to a folder and copy it to my internal IIS server which is connected to the domain. I have configured the IIS server (Windows Server 2016 / IIS Version 10) for windows authentication and disabled anonymous authentication. When I attempt to navigate to the application I get the following error...

Updated Error Message

Which refers to the following code:

public class ClaimsLoader{
public static string Role { get; set; }
public static bool IsInGroup(ClaimsPrincipal User, string GroupName)
{
    bool check = false;
    var user = (WindowsIdentity)User.Identity;
    if (user.Groups != null)
    {
        foreach (var group in user.Groups)
        {
            check = group.Translate(typeof(NTAccount)).ToString().Contains(GroupName);
            if (check)
                break;
        }
    }
    return check;
} }

And the controller referencing this is:

if (ClaimsLoader.IsInGroup(User, _config.GetValue<string>("Admin"))){
            ClaimsLoader.Role = "Administrator"; 
        }
        else if (ClaimsLoader.IsInGroup(User, _config.GetValue<string>("Modify")))
        {
            ClaimsLoader.Role = "Modify";
        }
        else
        {
            ClaimsLoader.Role = "";
        }

Based on the articles I have read, this is the way to do this. Most are referencing .net core 2.0 so has something changed between the versions making this obsolete? I find it very frustrating that this works on IIS Express with windows Authentication but not on IIS.

This is my first post on here so, please let me know if I missed some information that is needed.

Edit: Here is the windows authentication settings in IIS. IIS Windows Authentication IIS Windows Auth Providers

Answer 1

I have created a test demo on my side and I could reproduce your issue now.

I guess you may enabled anonymous authentication and windows authentication at same time.

I suggest you could try to disable the anonymous authentication and enable the windows authentication and try again.