You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
src/WebService/Start-OfflineJoinService.ps1: the Web UI can now run without IIS. A new WebUi.AuthMode setting selects the authentication scheme:
'WindowsAd' (new default) serves a hosted HTML login form and validates the submitted AD credentials directly against Active Directory over the existing TLS channel, restricted to AdminGroup and backed by a server-side session cookie (with login/logout routes). This makes /ui usable when Pode is self-hosted standalone.
'IIS' keeps the previous behaviour, consuming the Windows identity forwarded by IIS's ASP.NET Core Module for seamless Kerberos single sign-on.
src/WebService/OfflineJoinWebUi.ps1: new Get-OdjLoginBody helper renders the standalone login form.
src/WebService/appsettings.psd1: documents the new optional WebUi.AuthMode key (defaults to 'WindowsAd').
Fixed
Standalone Web UI requests previously failed with HTTP 401 "No MS-ASPNETCORE-WINAUTHTOKEN header found" because Add-PodeAuthIIS only works behind IIS. The default WindowsAd mode resolves this without requiring IIS.
Documentation
docs/quickstart.md and docs/schnellstart.md: the Web UI for AD admins section now documents both WebUi.AuthMode values (standalone WindowsAd default vs. IIS).
README.md and docs/README.en.md: the Web UI description, the "Web UI hardening" security bullet, and the architecture-diagram /ui label reflect the new AD-group authentication with the WindowsAd/IIS modes instead of IIS-only Windows Authentication.
