Is there a way to expose a single aspx page for anonymous access in a .NET 4.7.2 ASP.NET Web Forms running with Azure AD Authentication?

Question

Is there a way to expose a single aspx page for anonymous access in a .NET 4.7.2 ASP.NET Web Forms running with Azure AD Authentication?

Ciaccio, Ed 0

We have a .NET 4.7.2 ASP.NET Web Forms application deployed under IIS running with Azure Active Directory Authentication.

The web app is registered as an application on Azure AD and requires users to login before accessing the site.

Is there a way to expose a single aspx page for anonymous access?

Or perhaps access the page via a token acquired from Azure, without requiring the user to login?

We are trying to return the aspx page as a byte array.

Prior to Azure AD, WebClient was used to access the page, passing in a username and password.

Below please find some sample code:

System.Net.WebClient webClient = new System.Net.WebClient();

Uri requestUri = new Uri(m_url);

System.Net.NetworkCredential credentials = new System.Net.NetworkCredential(SiteSettings.AlerterUserName, SiteSettings.AlerterPassword, SiteSettings.AlerterDomain);

System.Net.CredentialCache credentialCache = new System.Net.CredentialCache();

credentialCache.Add(new Uri(SiteSettings.SiteUrl), "NTLM", credentials);

webClient.Credentials = credentialCache;

byte[] raw = webClient.DownloadData(requestUri);

m_body += System.Text.Encoding.Default.GetString(raw);

This is no longer valid with Azure.

We have replaced the use of WebClient with HttpClient, however instead of the requested page being returned, the site is requiring a login:

string token = GetAccessToken();

using (HttpClient httpClient = new HttpClient())

{

httpClient.BaseAddress = new Uri(m_url);

httpClient.DefaultRequestHeaders.Remove("Authorization");

httpClient.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

byte[] raw = httpClient.GetByteArrayAsync(m_url).GetAwaiter().GetResult();

m_body += System.Text.Encoding.Default.GetString(raw);

}

The following is returned:

<!DOCTYPE html>

<head>

<title>Sign in to your account</title>

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<meta http-equiv="X-UA-Compatible" content="IE=edge">

<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">

...

Thank you,

Ed

1 answer

Your answer

Answer 1

Bruce (SqlWork.com) 75,621 Moderator

typically webform pages do not support bearer tokens, as they use cookie authentication. you need to add bearer token support to your application.

Ciaccio, Ed 0 Reputation points

2025-05-07T19:13:43.36+00:00

Thank you for the response.

Is that accomplished thru code and/or the Azure portal?
Bruce (SqlWork.com) 75,621 Reputation points Moderator

2025-05-07T19:27:12.5866667+00:00

You don’t explain your current configuration. Are you use azure easy auth, or the owin pipline and Microsoft identity?
Ciaccio, Ed 0 Reputation points

2025-05-07T19:38:31.1966667+00:00

Owin pipline and Microsoft identity.

We mostly followed:

https://devblogs.microsoft.com/premier-developer/convert-asp-net-webforms-with-windows-authentication-to-use-aad/
Bruce (SqlWork.com) 75,621 Reputation points Moderator

2025-05-08T16:19:35.34+00:00

The official docs for the old framework are slowly disappearing. You will need to google for examples. But basically you add UseJwtBearerAuthentication middleware and configure it. As both middleware will run on each request, either one can create the principal.
Ciaccio, Ed 0 Reputation points

2025-05-08T21:32:52.5866667+00:00

From what I can see, JwtBearer requires .NET Core; this is a .NET 4.7.2 WebForms app.
Bruce (SqlWork.com) 75,621 Reputation points Moderator

2025-05-13T16:17:46.36+00:00

the owin pipeline supports jwt tokens. google for examples,
Ciaccio, Ed 0 Reputation points

2025-05-13T18:00:19.4833333+00:00
I ended up installing Microsoft.IdentityModel.JsonWebTokens and added the following to Startup.cs:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions

{

*AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,* *TokenValidationParameters = new TokenValidationParameters* *{* *ValidateIssuer = true,* *ValidIssuer = aadInstance,* *ValidateAudience = true,* *ValidAudience = redirectUrl,* *ValidateLifetime = true,* *ValidateIssuerSigningKey = true* *}*

});

The token seems to be acquired successfully as per the screenshot.

However when trying to access the aspx page using the token, Azure requires a signin:

httpClient.DefaultRequestHeaders.Authorization = AuthenticationHeaderValue.Parse(token.CreateAuthorizationHeader());

byte[] raw = httpClient.GetByteArrayAsync(PathToASPXPage).GetAwaiter().GetResult();

<head>

<title>**Sign in to your account**</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">

I wonder if the ASPX page needs to be changed to an API call.

Share via

Is there a way to expose a single aspx page for anonymous access in a .NET 4.7.2 ASP.NET Web Forms running with Azure AD Authentication?

1 answer

Your answer