IUSR when deploying to IIS 7.5

[laurentgrangeau]

Hi,

First of all, thank you for your extension. It works great in Visual Studio :)

But when I'm publishing my website in IIS, I can't authenticate myself with NTLM.
I've got "IUSR" instead of "DOMAIN\Username" in the menu.

And when I disable Anonymous authentication, I get 404.15 HTTP Error Code with following URL :
http://localhost:47348/Windows/Login?ReturnUrl=%2FWindows%2FLogin%3FReturnUrl%3D%252FWindows%252FLogin%253FReturnUrl%253D%25252FWindows%25252FLogin%25253FReturnUrl%25253D%2525252FWindows%2525252FLogin%2525253FReturnUrl%2525253D%252525252FWindows%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FWindows%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FWindows%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FWindows%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FWindows%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FWindows%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FWindows%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FWindows%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FWindows%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FWindows%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FWindows%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FWindows%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FWindows%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252FWindows%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FWindows%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FWindows%252525252525252525252525252525252525252FLogin%252525252525252525252525252525252525253FReturnUrl%252525252525252525252525252525252525253D%25252525252525252525252525252525252525252F

Can you help me please ? :)

[MohammadYounes]

Hi,

You got into an infinite loop due to disabling anonymous authentication, making the query string ever expanding! which caused the 404.15 error.

Both anonymous/windows authentication modes should be enabled, as the name implies (mixed).

Sorry! but I wasn't able re-produce your issue, if you can provide more details on the environment, configuration or code changes you have made!

[laurentgrangeau]

Hi,

When enabling both authentication, the infinite loop disapears.

But when I publish my solution on IIS Server, I'm not able to get my 'Domain\Username'. I only get 'IUSR' (which is the IIS user)
My configuration is 'DefaultAppPool', with Integrated pipeline.

[MohammadYounes]

IUSR is the default anonymous user account, the only case I found where LogonUserIdentity contained IUSR was when the user has already been forms authenticated. I'm still unable to re-produce your issue.

[laurentgrangeau]

Ok, I think I've made some modification to your code that break the MixedAuth...
My need is to automatically login a Windows user if an application setting is set in the web.config.

I change the Login method in the AccountController :
[AllowAnonymous]
public async Task Login(string returnUrl)
{
if (bool.Parse(ConfigurationManager.AppSettings["WindowsAuthentication"]))
{
await WindowsLogin(null, returnUrl);
}

        ViewBag.ReturnUrl = returnUrl;

        return View();
    }

Is it OK ?

[MohammadYounes]

No, its not OK. The WindowsLogin action should be called only after the right identity exists inside Request.LogonUserIdentity, See the request processing logic inside WindowsLoginHandler.

[laurentgrangeau]

Thank you, I'll look at your WindowsLoginHandler implementation.
So how can I identify automatically my Windows user without required them to click on the Windows Login button ?

[MohammadYounes]

You can configure the solution to start by auto windows login, as described here #6 also Its found under WindowsFirst branch.

[laurentgrangeau]

Ok, it seems to work now without my modifications and with Windows first :)
Thank you four your reactiveness