IIS Express and windows only authentication does not work

[jruckert]

Hi,

I've been trying to get Windows Authentication working by itself under IIS Express, and unless i have both "Windows Authentication" and "Anonymous Authentication" selected under the project properties I cannot run/debug the application in Visual Studio 2015.

Running under a command prompt, the application works using Kestrel + WebListener, so i have ruled out the application being the issue.

Error Message:

Configuration:

web.config file under wwwroot

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <handlers>
      <add name="httpPlatformHandler" path="*" verb="*" modules="httpPlatformHandler" resourceType="Unspecified" />
    </handlers>
    <httpPlatform processPath="%DNX_PATH%" arguments="%DNX_ARGS%" forwardWindowsAuthToken="true" startupTimeLimit="3600" />
  </system.webServer>
</configuration>

applicationhost.config (under the project/.vs/config directory - Note it tends to create multiple entries here and under when you turn off/on authentication options - not sure if this is any issue.

<site name="Manage.Web(1)" id="2">
        <application path="/" applicationPool="Clr4IntegratedAppPool">
          <virtualDirectory path="/" physicalPath="C:\Repos\manage-ui\src\Manage.Web\wwwroot" />
        </application>
        <bindings>
          <binding protocol="http" bindingInformation="*:28249:localhost" />
        </bindings>
      </site>

....

<location path="Manage.Web(1)">
        <system.webServer>
            <security>
                <authentication>
                    <anonymousAuthentication enabled="false" />
                    <windowsAuthentication enabled="true" />
                </authentication>
            </security>
        </system.webServer>
    </location> 

Am i missing something?

[Tratcher]

@BillHiebert

[davidfowl]

@jruckert Try getting more information by setting up the stdout log file. Set stdoutLogEnabled="true" and stdoutLogFile="httpplatform-stdout" and see if the file gives any clues.

[jruckert]

I've just tried to start without debugging and this seems to be working and generates the log file (i can then attach to the process manually), however start with debugging does not generate a log file at all and gives the above error. This may be a tooling issue then?

[davidfowl]

Yep, it might be.

[davidfowl]

Can you try a new project and see if you get the same behavior?

[jruckert]

Just created (from the beta8 template) : https://github.com/jruckert/WindowsAuthOnly
i get the following

[BillHiebert]

The dnx process is failing to start. Can you enable logging to see what the startup error is? Set stdoutLogEnabled="true" in your web.config file (httpPlatform element).

[bill-long]

I'm seeing the same problem. I set stdoutLogEnabled="true", but it doesn't generate a log when I have only Windows checked in the project properties. It fails with the DNX error, but I get no output.

If I check both Windows and Anonymous, then it successfully launches when I F5 and generates a log. That log says authorization is failing (I put the [Authorize] attribute on the ValuesController in the Web API template project):

Process Id: 16420
Waiting for the debugger to attach...
Debugger attached.
Hosting environment: Development
Now listening on: http://localhost:4114
Application started. Press Ctrl+C to shut down.
warning : [Microsoft.AspNet.Mvc.Controllers.ControllerActionInvoker] Authorization failed for the request at filter 'Microsoft.AspNet.Mvc.Filters.AuthorizeFilter'.

[BillHiebert]

I opened a bug in our internal TFS database to track fixing this.

[Tratcher]

Ok, it looks like there's a problem with how tooling is launching the process under debug. The only workaround at the moment is to also enable Anonymous.

[mrsheepuk]

I'm hitting this same problem, as is at least one other person over at Stack Overflow - if I can provide any additional info to what you already have, please shout!

[mrsheepuk]

@Tratcher Another workaround (of sorts) is to debug using WebListener by changing the web command in project.json (as an aside, however, Visual Studio really seems to like changing this back to Microsoft.AspNet.Hosting.Kestrel without asking me :) ):

"commands": {
  "web": "Microsoft.AspNet.Hosting --server Microsoft.AspNet.Server.WebListener --server.urls http://localhost:5002"
},

Editing the project.json externally to Visual Studio then opening the solution allows me to debug using Windows Authentication, albeit self-hosted via WebListener rather than IIS Express, so is a good workaround to get on with things while the IIS Express problem is worked on.

[bill-long]

Note that while enabling Anonymous does allow the project to launch, authentication to an API endpoint with an [Authorize] attribute will still fail. It appears WebListener is the best approach for now.

[Tratcher]

@mrsheepuk Yes, that works, but you have to enable WebListener's windows auth in Startup. You can also add a separate command for weblistener.
"weblistener": "Microsoft.AspNet.Server.WebListener --server.urls http://localhost:5002/"

Yes, the tooling right now is too aggressive at making the web command suit its needs.

[mrsheepuk]

Indeed, for anyone who needs to get on with debugging, the line to enable WebListener auth in Startup Configure() is:

var listener = app.ServerFeatures.Get<WebListener>();
if (listener != null)
 {
     listener.AuthenticationManager.AuthenticationSchemes = 
         AuthenticationSchemes.NTLM;
 }

@Tratcher Useful to know about adding a separate command, I'll try that tomorrow!