Skip to main content

Windows authentication and special cases

Windows authentication is enabled server-side and requires configuring the execution environment, notably in development with IIS Express or when publishing to IIS.

Enable Windows authentication on the Lagoon side​

The AuthenticationOptions class exposes AllowWindowsAuthentication. The server pipeline must keep UseAuthentication() followed by UseAuthorization() before MapLagoonFallback().

Server\Main.cs
protected override void OnConfigureAuthentification(AuthenticationOptions options)
{
    // Active l'authentification Windows.
    options.AllowWindowsAuthentication = true;
}

If the Windows identifier must keep the domain name, use WindowsAuthenticationFullUserName.

Server\Main.cs
protected override void OnConfigureAuthentification(AuthenticationOptions options)
{
    options.AllowWindowsAuthentication = true;
    // Exemple : false -> UserName, true -> DOMAIN\UserName.
    options.WindowsAuthenticationFullUserName = true;
}

Development environment​

To enable Windows authentication in Visual Studio, open the server project properties and enable the corresponding setting.

You can also edit the launchSettings.json file in the Properties folder of the server project.

Notes
  • anonymousAuthentication must be enabled.
  • IIS Express must be used; Kestrel is not sufficient.
  • The Visual Studio Code debugger does not support Windows authentication.

Publishing to a local IIS​

Prerequisites​

Install the ASP.NET Core Hosting Bundle matching the .NET version targeted by the application.

IIS application pool​

  • Create one pool per Lagoon application.
  • The pool must not contain more than one application, otherwise issues may appear.
  • When creating it, set the .NET CLR version to No Managed Code.

Change the application root​

If the application is deployed at https://localhost/mon_application/, edit the wwwroot/index.html file in the publish folder to reflect the IIS root in the base href.

wwwroot\index.html
<base href="/monapplication/" />
Warning - all lowercase

Casing affects how the application works. The IIS site name, the publish folder name, and the base href must all be lowercase. The path must start and end with /.

Warning - sensitive URL

When publishing to a local IIS, the URL must end with /.

  • https://localhost/monapplication opens the application, but authentication issues may occur.
  • https://localhost/monapplication/ is the expected URL.

HTTPS support​

Your local IIS must be configured to accept HTTPS connections. This is not the case by default on a non-server Windows machine.

Check that an HTTPS binding exists on the IIS root node. If it doesn't, add an HTTPS binding.

Publishing to a production IIS​

The legacy documentation notes that this point still needs to be investigated further.

Deploying the application in a cluster​

When the same application is deployed on multiple servers, configure the key storage location in appsettings.json with Lagoon:Authentication:KeyStoreDirectoryPath.

The location can be a UNC path.

appsettings.json
{
  "Lagoon": {
    "Authentication": {
      "KeyStoreDirectoryPath": "\\server\share\keys"
    }
  }
}