0

I'm currently have a selfhosted WCF REST service. Using WebHttpBinding and Windows authentication, is it possible at all to get the password or do I have to use Basic authentication?

1 Answer 1

1

You can't get the user password using Windows auth - since the authentication is done via a third party (usually the active directory), no passwords are exchanged between the client and the service, only a token which is issued by the AD.

Being able to get the password using Windows auth would also be a huge security risk - in intranets clients (such as browsers) usually don't prompt the user for credentials when authenticating themselves to a server which requires that kind of authentication. You wouldn't want your password to be handed over to a service which you happen to visit that uses that kind of authentication.

3
  • Just so I understand correctly, some intranet pages can be accessed outside a domain (even a box running a Linux distro). In that case you have to pass a password. How would you authenticate otherwise if you didn't send your password?
    – ymerej
    Dec 27, 2011 at 13:46
  • In this case what usually happens is that a machine is used as a "gateway" or proxy for the machine outside the domain (the machine needs to be in the domain). The proxy runs a service which requires some sort of authentication which requires username / password, which then impersonates the caller and then calls the "final" page using that credential. Again, from the proxy to the final page no passwords are exchanged. Dec 27, 2011 at 15:27
  • I see what you are saying. Unfortunately I'm trying to make this as little as intrusive to the user as impossible. My goal was to delegate (vs impersonate) code under their account. I wanted to make it easy enough for the user not to bother the IT admin on allowing them to delegate, and instead use LogonUser API. It looks like I have to stick with basic authentication. I'll mark your response as the answer, since it does seem impossible to grab the password.
    – ymerej
    Dec 27, 2011 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.