0

I have inherited an internal website (NET6/MVC) that is set to allow both Anonymous Authentication and Windows Authentication. Mostly, it works. The controllers with attributes like [Authorize(Policy = Policy.SupportRead)] seem to do their job. However...

I have sections where the user name is required from AD. In the controller if I use HttpContext.User I seem to get ambiguous results after a user is logged in. Sometimes I get a ClaimsPrincipal, that is essentially empty, and sometimes I get the proper WindowsPrincipal. I can just refresh the page and it will get different results.

I'm honestly not sure where to start with this, here's some of the relevant code.

Startup.cs

 public void ConfigureAuth(IServiceCollection services)
 {
     services.Configure<CookiePolicyOptions>(options =>
     {
         options.CheckConsentNeeded = context => false;
         options.MinimumSameSitePolicy = SameSiteMode.None;
     });

     services.AddAuthentication(o =>
     {
         o.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
         o.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
         o.DefaultChallengeScheme = HttpSysDefaults.AuthenticationScheme;
     }).AddIdentityCookies();

     PolicyConfig.ConfigurePolicies(services);
 }

Later on in startup

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints =>
{
  endpoints.MapControllers();
  endpoints.MapControllerRoute(
      name: "default",
      pattern: "{controller=Home}/{action=Index}/{id?}");
});

Login controller method is very simple, honestly surprised this works, not sure what magic is happening. When the link to this method is clicked I get a chrome popup asking for windows credentials.

[Authorize]
public IActionResult Login()
{
    return RedirectToAction("Index", "Home");
}

But then I go here and user swaps between the two, WindowsPrincipal and ClaimsPrincipal, randomly each request.

[HttpGet]
[ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
public IActionResult Dashboard()
{
    var user = User;
    ....
}

Not a lot of experience with web auth. I don't think I have any related 3rd party nuget packages. Looks like just Microsoft.AspNetCode.Identity.

Pretty sure everything I've tried so far is just blind shots in the dark. Tried to call Logout() in the login method since it seems like I'm logged in twice. Tried messing with the startup config. Tried removing that ResponseCache attribute since I don't really know what it's doing. Looked in Chrome Dev tools for a security cookie, which I'm not seeing as far as I can tell.

The closest thing I've found that relates to this is User.Identity fluctuates between ClaimsIdentity and WindowsIdentity But I'm not quite sure it's the same. User.Identities.Count is always 1 in my case.

If I keep repeatedly logging in on the site eventually it seems to stick, but obviously not a great user experience.

Let me know if I need to provide more code.

EDIT: From the linked issue, var user = HttpContext.Features.Get<WindowsPrincipal>(); this always returns null for me.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
spiral
  • 47
  • 8
  • `User.Identities.Count is always 1 in my case` You can try to specify ***AuthenticationSchemes*** with the `Authorize` attribute `[Authorize(AuthenticationSchemes = $"{CookieAuthenticationDefaults.AuthenticationScheme},{HttpSysDefaults.AuthenticationScheme}")]` , then you can access the [multiple identities](https://i.stack.imgur.com/3PAm5.png). – Fei Han Apr 05 '23 at 05:45
  • InvalidOperationException: No authentication handler is registered for the scheme 'Cookies'. The registered schemes are: Identity.Application, Identity.External, Identity.TwoFactorRememberMe, Identity.TwoFactorUserId, Windows. Didn't work but at least I get more information about what may be going on. – spiral Apr 10 '23 at 14:54
  • Have you tried `[Authorize(AuthenticationSchemes = $"{"Identity.Application"},{HttpSysDefaults.AuthenticationScheme}")]`? – Fei Han Apr 12 '23 at 03:13
  • Tried `Identity.Application` and `Windows`. They run just fine and seem to log me in as usual, but don't fix the problem :( I've also tried putting `` in the `web.config`. It seemed like it helped at first but now it's doing the same thing. – spiral Apr 13 '23 at 15:33

0 Answers0