Question about Windows Auth

[rakhimzhanov]

Hello Tom,

Could you please advise, can Ocelot authenticate using windows auth to services where windows auth also enabled? (I mean if gateway and services works only with windows auth)

Thank you.

[TomPallister]

@rakhimzhanov thanks for your interest in the project.

I have not written anything specific for Windows Authentication. However I think you could get Ocelot using it following this guide https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?tabs=aspnetcore2x and the Ocelot docs http://ocelot.readthedocs.io/en/latest/features/authentication.html

You need to get windows auth registered as with provider then associates it’s key with reroutes in Ocelot.

Now in terms of forwarding Windows auth to downstream services I’m not sure how this would work. My experience with Windows auth is limited. If the downstream service needs a header then Ocelot should be able to forward this on from the upstream request.

Let me know if that helps and if not this might be a feature for the future.

[soumaz]

I am still facing issues with Windows Authentication. Has this been fixed in the latest Ocelot version?

My gateway is a virtual directory hosted under default site with anonymous access.
And my services are hosted under another virtual directory with windows authentication enabled.

Note: - in IE options settings for "Enable Integrated windows authentication is enabled" from user machine. This is required otherwise the domain.com will not carry the identity.

Default website
----> Gateway = anonymous
-----> services = windows authentication.

With this from user machine when we call with servername.domain.com/gateway/ to get the user name from services, we get the user name for first user.

When the same url is hit by another user he gets the username of the first user, whereas the should have got is his own user name.

what we see is that persist-auth in headers is set to true for communication between gateway and services.

Please assist on the same.

[TomPallister]

@soumaz I am not sure why this doesn't work, can you debug and submit a PR to fix?

Unfortunately I don't have time to debug learn and fix this issue :(

[Sacrilege]

@TomPallister I created a PR for this as I needed it too: #1521