Windows Authentication - How User Credentials Are Picked Up

Windows Authentication is a robust and seamless way to secure your ASP.NET MVC applications, especially within corporate environments where users are already logged into a Windows domain. This article explores how Windows Authentication works in ASP.NET MVC, detailing the process of how user credentials are picked up and authenticated by the system.

Step-by-Step Process:

Client Request Initiation:

• When a user tries to access your ASP.NET MVC application, their browser initiates a request to your web server (IIS).

IIS Intercepts the Request:

• Upon receiving the request, IIS checks the authentication settings for the application.

• Since Windows Authentication is enabled and other authentication methods like Anonymous Authentication are disabled, IIS decides to use Windows Authentication to validate the user.

Negotiation Protocol:

• Windows Authentication typically uses protocols such as NTLM (NT LAN Manager) or Kerberos.

• NTLM: An older authentication protocol that relies on a challenge-response mechanism.

• Kerberos: A more secure and efficient protocol that uses ticket-based authentication and relies on a trusted third party (the Key Distribution Center, or KDC).

Credentials Exchange:

• The browser and IIS engage in a series of exchanges to authenticate the user.

For NTLM:

• IIS sends a challenge to the browser.

• The browser responds with the user’s hashed credentials.

• IIS validates these credentials against the domain controller.

For Kerberos:

• The browser requests a ticket from the KDC.

• The KDC verifies the user’s credentials and issues a ticket.

• The browser sends this ticket to IIS.

• IIS validates the ticket with the KDC.

Validation:

• IIS validates the user’s credentials against the Active Directory.

• If the credentials are valid, IIS accepts the request.

• If the credentials are invalid, the request is denied, and an authentication prompt may appear in the browser.

Access Token Generation:

• Upon successful authentication, IIS generates an access token for the user.

• This token contains the user’s identity and group memberships, which will be used for authorization within the application.

Forwarding the Request:

• IIS forwards the authenticated request to the ASP.NET MVC application along with the user’s identity.

• The user’s identity is encapsulated in the HttpContext.User property, accessible within the application.

User Information in ASP.NET MVC:

• Inside your controller actions, you can access the user’s identity using the User property.

public ActionResult Index()
{
    // Get the full username (DOMAIN\Username)
    string userName = User.Identity.Name;

    // Check if the user is authenticated
    bool isAuthenticated = User.Identity.IsAuthenticated;

    // If you need detailed information
    WindowsIdentity windowsIdentity = User.Identity as WindowsIdentity;
    if (windowsIdentity != null)
    {
        string domain = windowsIdentity.Name.Split('\\')[0];
        string username = windowsIdentity.Name.Split('\\')[1];
    }

    return View();
}

Detailed Example:

1. Client Side:

• User Alice from domain CORP opens a browser and navigates to http://yourapp.

2. Server Side (IIS):

• IIS receives the request and sees that Windows Authentication is enabled.

• IIS challenges the browser (e.g., sending a 401 Unauthorized response with a WWW-Authenticate header).

3. Client Side (Browser):

• The browser recognizes the challenge and sends back Alice’s Windows credentials (e.g., as a Kerberos ticket).

4. Server Side (IIS):

• IIS uses the domain controller to validate the credentials.

• If the credentials are valid, IIS generates an access token for Alice.

• IIS forwards the request to the ASP.NET MVC application, including Alice’s identity.

5. ASP.NET MVC Application:

• The application receives the request and accesses Alice’s identity through HttpContext.User.

By following this detailed process, IIS ensures that the user accessing the application is authenticated using their Windows credentials. The ASP.NET MVC application then uses this information for further authorization and user-specific logic.