dotnet / dotnet/AspNetCore.Docs

Clarification request in "Configure Windows Authentication in ASP.NET Core"

Open
#27,049 2 comments 0 reactions 0 assignees View on GitHub
area-security re-Safia Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

**EDIT by @Rick-Anderson***
Regarding the [Kestrel](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-6.0&tabs=visual-studio#kestrel) section of this document, specifically the [warning and info blockquotes](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-6.0&tabs=visual-studio#kestrel) near the start of the section.

> Warning
> Credentials can be persisted across requests on a connection. Negotiate authentication must not be used with proxies unless the proxy maintains a 1:1 connection affinity (a persistent connection) with Kestrel.

For the warning blockquote, I was working through a new project targeting .NET 6.0 and found NTLM/Kerberos credential persistence was not enabled by default.
It may be beneficial to mention whether or not the code sample that follows results in the scenario described in the warning blockquote.
If you create a new Razor/Blazor project from template and deploy it to an IIS server, would credential persistence be an issue?
These kinds of examples are sometimes included in Microsoft Docs and I find them very informative, or at the very least they help understand the context, etc.

For the note blockquote:
> The Negotiate handler detects if the underlying server supports Windows Authentication natively and if it is enabled. If the server supports Windows Authentication but it is disabled, an error is thrown asking you to enable the server implementation. When Windows Authentication is enabled in the server, the Negotiate handler transparently forwards authentication requests to it.

it is implied that if the platform/server supports Windows/Negotiate authentication natively, magic and smoke will pester you to enable the native implementation (rather than performing the authentication "in-process"?).
Could this be better detailed or an example be included to clarify what this pertains to?
If you create a new Razor/Blazor project from template and deploy it to an IIS server, would you receive this error if IIS has Windows Authentication disabled?

If clarification on these two blockquotes can be provided, I can author a change to the doc if suitable.

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: 401ad9a0-9e51-80a2-5846-82e9790d7257
* Version Independent ID: fbc36c26-9992-1f4c-66d3-02f898ee7ec4
* Content: [Configure Windows Authentication in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-6.0&tabs=visual-studio)
* Content Source: [aspnetcore/security/authentication/windowsauth.md](https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/windowsauth.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-security**
* GitHub Login: @Rick-Anderson
* Microsoft Alias: **riande**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.