Implementing Windows Authentication in Web Api using .Net 4.8 (Not Core)

Question

I have an existing Web Api project build with .Net 4.8. In production, I have both Web Api and Angular based web site deployed in IIS in Windows 2022. The database, SQL Server 2017, is running on separate Windows 2022 machine. Both servers are in same domain. The web site is intranet type used by internal users only.

The Web version is a replacement to old Windows Form GUI. Currently both Windows Form GUI and Web version are connecting to same database.

Aim: When a domain user runs Windows Form GUI, database returns data based on domain user access rights. The Web Api is running with Anonymous authentication and the need is to implement Windows Authentication such that database knows domain user and returns data similar to Windows Forms . I couldn't find any detail instructions on internet how to achieve it in .Net4.8 project.

Constraint: Any changes to database is out of project scope.

Can someone help with right information how to implement Windows Auth in .Net4.8?

Answer 1

Hi @Shastri, Shrinivas,

To enable Windows Authentication within an ASP.NET Application, you should make sure that you have “Integrated Windows Authentication” enabled within IIS for the application you are building. 

The documentation below has detailed steps.

Integrated Windows Authentication

Windows Authentication <windowsAuthentication>

You should then add a web.config file to the root of your ASP.NET application that contains an <authentication> section that sets the mode to "Windows".

You should then also add the <authorization> section to the same web.config file to deny "anonymous" users access to the site. The specific configuration is as follows:

<configuration>
    <system.web>
        <authentication mode="Windows" />
         <authorization>
             <deny users="?"/>
          </authorization>    
    </system.web>
 
</configuration>

Best regards,
Lan Huang

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

see the docs about IIS windows user impersonation:

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation

also unless the webserver and sqlserver are on the same box, you will run into the one hop rule. so you will need to enable credentials delegation on webserver, and use kerberos for authentication: