.NET OWIN Authentication - Cookie + Windows (active directory)

Question

I'm currently working on a project which has an authentication requirement which is causing me some problems and I'd like some guidance on the best way to achieve it.

I have an internet C# MVC 5 project which currently has OWIN cookie authentication in place for external users. We now need to allow internal users to be able to access the application through Active Directory. Basically, an internal user would log in to their Windows computer, navigate to the website and they'll be signed in.

I don't have any experience of doing AD authentication, so it's a bit of a black hole at the moment.

I'm assuming, using OWIN, I need to create a new authentication middleware that can run before my cookie authentication.

However, I'm not sure where to start with setting this AD middleware up, or whether there is an existing one I can use.

I've tried searching around but can't seem to find much information on doing AD authentication through OWIN, there's just a lot about Azure AD.

I did come across this one https://github.com/MohammadYounes/OWIN-MixedAuth , but running locally, it's using Windows basic authentication, perhaps this can be adjusted for my purposes?

Could someone offer some advice on how to achieve this?

Thank you!

Answer 1

I was facing the same problem not-so-long ago, and went the route to use NTLM authentication (which boils down to what you want, intranet users will be "signed-in" automatically) while keeping full application accounts (ASP:NET Identity 2.0), you may want to check my OWIN NTML authentication middleware:

https://github.com/pysco68/Pysco68.Owin.Authentication.Ntlm

You will need to add a route to you "accounts controller" to handle the sign-in with NTLM and the creation of a local application account (if required). As a comfort-feature you could add an automatic redirect to that sign-in route for users from your intranet.

I hope this helps.

Answer 2

The link you came across is using Integrated Windows authentication NOT basic authentication .

I think your situation is similar to this one . The same can be achieved using OWIN-MixedAuth as per this comment .