Mixed (Windows + Forms) Authentication for OWIN
C# JavaScript ASP HTML CSS
Permalink
Failed to load latest commit information.
src Update Startup.Auth.cs Apr 1, 2016
.gitignore Initial commit Oct 18, 2014
LICENSE Initial commit Oct 18, 2014
README.md State applicationHost.config location more clearly Jan 12, 2016

README.md

OWIN Mixed Authentication

OWIN middleware implementation mixing Windows and Forms Authentication.

mixed-auth

Install with NuGet

PM> Install-Package OWIN-MixedAuth

Running the samples

Before running the samples, make sure to unlock windowsAuthentication section:

IIS

  1. Open IIS Manager, select the server node, then Feature Delegation.
  2. Set Authentication - Windows to Read/Write

    unlock-section

IIS Express

  1. Open applicationhost.config located at:
    • Pre VS2015: $:\Users\{username}\Documents\IISExpress\config
    • VS2015: $(SolutionDir)\.vs\config
  2. Search for windowsAuthentication section and update overrideModeDefault value to Allow.

    <section name="windowsAuthentication" overrideModeDefault="Allow" />

Usage

  1. Add reference to MohammadYounes.Owin.Security.MixedAuth.dll

  2. Register MixedAuth in Global.asax

    //add using statement
    using MohammadYounes.Owin.Security.MixedAuth;
    
    public class MyWebApplication : HttpApplication
    {
       //ctor
       public MyWebApplication()
       {
         //register MixedAuth
         this.RegisterMixedAuth();
       }
       .
       .
       .
    }
  3. Use MixedAuth in Startup.Auth.cs

    //Enable Mixed Authentication
    //As we are using LogonUserIdentity, its required to run in PipelineStage.PostAuthenticate
    //Register this after any middleware that uses stage marker PipelineStage.Authenticate
    
    app.UseMixedAuth(cookieOptions);

    Important! MixedAuth is required to run in PipelineStage.PostAuthenticate, make sure the use statement is after any other middleware that uses PipelineStage.Authenticate. See OWIN Middleware in the IIS integrated pipeline.

  4. Enable Windows authentication in Web.config

    <!-- Enable Mixed Auth -->
    <location path="MixedAuth">
      <system.webServer>
        <security>
          <authentication>
            <windowsAuthentication enabled="true" />
          </authentication>
        </security>
      </system.webServer>
    </location>

    Important! Enabling windows authentication for a sub path requires windowsAuthentication section to be unlocked at a parent level.


Importing Custom Claims

Adding custom claims in OWIN-MixedAuth is pretty straightforward, simply use MixedAuthProvider and place your own logic for fetching those custom claims.

The following example shows how to import user Email, Surname and GiveName from Active Directory:

// Enable mixed auth
 app.UseMixedAuth(new MixedAuthOptions()
 {
   Provider = new MixedAuthProvider()
   {
     OnImportClaims = identity =>
     {
       List<Claim> claims = new List<Claim>();
       using (var principalContext = new PrincipalContext(ContextType.Domain)) //or ContextType.Machine
       {
         using (UserPrincipal userPrincipal = UserPrincipal.FindByIdentity(principalContext, identity.Name))
         {
           if (userPrincipal != null)
           {
             claims.Add(new Claim(ClaimTypes.Email, userPrincipal.EmailAddress ?? string.Empty));
             claims.Add(new Claim(ClaimTypes.Surname, userPrincipal.Surname ?? string.Empty));
             claims.Add(new Claim(ClaimTypes.GivenName, userPrincipal.GivenName ?? string.Empty));
           }
         }
       }
       return claims;
     }
   }
 }, cookieOptions);

Please share any issues you may have.