ASP.NET Core Windows Authentication except specific paths

[madrianr]

in our ASP.NET Core solution we use Windows Authentication but for one path we need anonymous Access because it is the path for the WOPI Access from Office Online Server like api/wopi/files/{id}

is there a possibility to except specific paths in ASP.NET CORE with Windows Authentication?

robert

[Tratcher]

A sample will be provided as part of https://github.com/aspnet/AuthSamples/issues/15

You're using IIS, correct? In IIS enable Windows and Anonymous. Then on all of your controllers that require auth specify [Authorize]. If this is for ASP.NET Core 2.0 then also add services.AddAuthentication(IISDefaults.AuthenticationScheme) in Startup.ConfigureServices.

[madrianr]

It seems that isn't enough - what about classes which we Inject into our views?
we have a class which we inject into our view in the _ViewImports.cshtml like this:
@Inject IObjektberechtigungen Objektberechtigungen

in this class we make database calls with RunImpersonated like this:

var callerIdentity = context.User.Identity as WindowsIdentity; WindowsIdentity.RunImpersonated(callerIdentity.AccessToken, () => { result = db.Query<T>(sql, parameters, commandType: System.Data.CommandType.StoredProcedure); });

I can specify [Authorize] for this class but it seems this doesn't work - there is always a error in the line:
WindowsIdentity.RunImpersonated(callerIdentity.AccessToken,
NullReferenceException: The object reference was not set to an object instance.

we use IISExpress with VS 2017 and targeting NET 4.6.2

Robert

PS: isn't it possible to have only Windows authentication and use [AllowAnonymous] on specific Controllers/Actions to allow without authentication?

[Tratcher]

The authorize attribute goes on you mvc controller class. Or are you using razor pages instead?

[madrianr]

solved it now - set the following to have authorization on every Controller

    `services.AddMvc(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            })`

and use [AllowAnonymous] for those where I don't need it

[code2expert]

Is there a way to authenticate to active directory by using a form instead of the default pop-up form with username and password that prompts anytime youre opening the app?