简体   繁体   中英

IIS Windows Authentication - Change User - issue with IIS 8.5

Note: The below issue only occurs in IE 11, and works fine with Chrome

In our intranet we are setup to use purely windows authentication for all our web applications. The setup consists of a home page web app, and few other web applications linked from the home page, each application and home page are in separate application pools. We have implemented Change User functionality using the standard 401 redirects as mentioned at 'Login as another user' MVC 4 Windows Authentication .

The current hosting server is Windows Server 2008 R2 and we are doing our due diligence for migrating to Windows Server 2012 R2.

During testing we found that the Change User functionality works fine on the home page, but when accessing any other app the logged in user returns back to the original logged in user. The links are opened in a new tab by using _target='blank' from the home page.

Same application hosted on Windows 2008 R2 functions as expected and the Changed User is reflected on the other web applications as well.

I have tried googling without any matching experience, is this a known issue and are there any workarounds to fix the same?

Sample setup and output:

Windows Server 2008 R2 (IIS 7.5)

╔═══════════╦══════════════════════╦═══════════════════════╗
║ Time-Step ║     Url-Location     ║     Current-User      ║
╠═══════════╬══════════════════════╬═══════════════════════╣
║         1 ║ /HomePage            ║ MyDomain\OriginalUser ║
║         2 ║ /HomePage/ChangeUser ║ MyDomain\NewUser      ║
║         3 ║ /MyApp               ║ MyDomain\NewUser      ║
╚═══════════╩══════════════════════╩═══════════════════════╝

Windows Server 2012 R2 (IIS 8.5)

╔═══════════╦══════════════════════╦═══════════════════════╗
║ Time-Step ║     Url-Location     ║     Current-User      ║
╠═══════════╬══════════════════════╬═══════════════════════╣
║         1 ║ /HomePage            ║ MyDomain\OriginalUser ║
║         2 ║ /HomePage/ChangeUser ║ MyDomain\NewUser      ║
║         3 ║ /MyApp               ║ MyDomain\OriginalUser ║
╚═══════════╩══════════════════════╩═══════════════════════╝

The current user information is accessed using User.Identity.Name

Solved: The order of the providers in Windows authentication matters. The issue was solved once we moved the NTLM above Negotiate in the providers list.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM