基本 Angular SPA 与 .NET Web ZDB974238714CA8DE634A7CE1SSOD083A14FZ 连接 - 实现

Question

I Will try to describe this as detailed as possible.

For using the SPA, you need to be logged-in, every request is authenticated by JWT. Login is a simple form with Username and Password fields, which are sent to the server. On the server, there are two types of login (kinda) - AD and Password (determinated by the user type):

1. API check if username exists and determine its Type
2. a) if type is Password: Check if password matches the data in Database
3. b) if type is AD: verify password on the LDAP server
4. successful login returns generated JWT, which is used for all further requests.

This App is available all over the internet, not just inside the same network as the server.

I would like to have some kind of "automatic login" with Windows account (so you dont need to manually type the username/pass, but the SPA tries to login automatically when u open the Login page).

I tried many guides for something like this, but nothing seems to work properly.

I heard that Kerberos/Auth0 should do the work, but I dont know how to implement it. Also I would still need to get that JWT for further requests. Do I need some kind of Microsoft request? Azure? Anything else? (If is needed, I can create another IIS application just with Login controller).

I hope you understand what I mean, and will be able to help!

Answer 1

Most Modern Browsers speak SPNEGO

Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), often pronounced "spenay-go", is a GSSAPI "pseudo mechanism" used by client-server software to negotiate the choice of security technology.

It just so happens that one of those client-server security technologies it can speak is Kerberos. ( Windows machines generally have kerberos availble by default .).

So to actually get .NET to use kerberos authentication you really need to enable delegation for IIS as that's what speaks to the browser.