Indicate if Windows Auth is enabled in IIS

[Tratcher]

UseIISIntegration integrates with the Authentication components to handle Authenticate and Challenge. However, right now it can't tell if Windows Auth is enabled in IIS, so it has to assume it is and issue the challenge blindly. This causes odd behavioral differences between IIS and SelfHost.

It would be cleaner if ANCM indicated to the app at startup if Windows Auth was enabled, possibly via environment variable. E.g ASPNETCORE_IISWINDOWSAUTH=Enabled/Disabled/... (or give the individual type names?) Then UseIISIntegration could turn on or off those components.

/cc: @HaoK

[shirhatti]

Do we need this 2.0? Trying to figure out prioritization.

[Tratcher]

We want it for 2.0 so we can work it in with our Auth rewrite, but it's lower priority than most of the other things we've asked you for.

[shirhatti]

@pan-wang just looked into it. Turns out it is feasible.

@Tratcher @HaoK

• Do you need more information besides just a binary Enabled/Disabled? While we can certainly flow the information, will it add any value?
• We can use the environment variable name that Chris suggested. ASPNETCORE_IISWINDOWSAUTH that takes possible values as Enabled and Disabled. Does that work?

[Tratcher]

@pan-wang how much information is readily available about windows auth? Enabled/Disabled is the minimum bar. Enabled schemes might be a bonus. E.g. NTLM;Kerberos;Anonymous; etc..

Client Certificate mapping to a windows identity is not covered by this, correct? It's not a kind of auth we can challenge for.

[pan-wang]

We are reading IIS configuration and theoretically we can get all configured info . Unfortunately, the schemes are not defined in configuration.

…

________________________________ From: Chris R <notifications@github.com> Sent: Thursday, April 6, 2017 6:42:41 AM To: aspnet/AspNetCoreModule Cc: pan-wang; Mention Subject: Re: [aspnet/AspNetCoreModule] Indicate if Windows Auth is enabled in IIS (#82) @pan-wang<https://github.com/pan-wang> how much information is readily available about windows auth? Enabled/Disabled is the minimum bar. Enabled schemes might be a bonus. E.g. NTLM;Kerberos;Anonymous; etc.. Client Certificate mapping to a windows identity is not covered by this, correct? It's not a kind of auth we can challenge for. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#82 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ARVK2wtxACkoXmNhhVfwOyZtTpbS7t4eks5rtMGhgaJpZM4MtN7j>.

[Tratcher]

This section? https://www.iis.net/configreference/system.webserver/security/authentication
How about `Anonymous;Basic;Digest;Windows'

Basic and Digest still use your windows credentials, correct?

[Tratcher]

ASPNETCORE_IIS_HTTPAUTH=Anonymous;Basic;Windows or None.
Excluding Digest as unused/obsolete.

Client cert mapping:
@HaoK, would it make sense to have a separate auth handler registered for client cert auth that issued a 495 SSL Certificate Error for Forbid and a 496 SSL Certificate Required for Challenge (values taken from nginx https://en.wikipedia.org/wiki/List_of_HTTP_status_codes)? We could light this up with a separate variable ASPNETCORE_IIS_CERTAUTH=true.

[muratg]

Fixed in #102.