2

I have two applications: one is WebAPI REST Service written on .NET 4.5, and another one is its client application written on .NET Core 2. There's a windows authentication enabled on the service side. Client one makes simple GET call using HttpClient with HttpClientHandler loaded with credentials from configuration, it is some service account. Very basic stuff that can easily be googled in tons of examples, there's nothing fancy there at all.

When this call is performed from my local dev laptop to DEV server then everything works as expected: user provided in the client's configuration gets authenticated successfully on the service and is able to perform whatever operations he is allowed to perform.

It also works fine if I perform this call from the browser (Chrome) - it asks me for credentials and then returns result that perfectly correlates with whatever credentials I put there. It works this way with both remote and local services.

However, if I run the service locally on my laptop (local IIS Server, not an Express one) and call is performed using localhost address then I observe strange behavior: windows authentication seems to work as well, but the user that service authenticates is not the one from client's configuration. Instead, it is my AD account with which I have logged on interactively in windows (btw, it's win 10 ent x64).

Of course, I've verified five times every single config setting and runtime value in my applications, all settings on local and dev server's IIS, on web application and IIS Server level and app pools used for apps. Everything I see looks good - except it behaves differently when on localhost. Also, I googled every question that I could imagine but still can't seem to find an explanation to this behavior.

So, why HttpClient uses my account on the localhost instead of explicitly provided credentials? What am I missing here?

5
  • Does your browser show the credential window when you connect to your local IIS ? The behavior you're seeing is the same on local and remote IIS? Mar 27, 2018 at 6:17
  • Is the DEV server joined to the AD domain of your working laptop? or is it a stand-alone or joined to another domain? Mar 27, 2018 at 6:18
  • Probably silly to ask, but: Did you compare every setting regarding authentication of local and dev IIS?
    – Fildor
    Mar 27, 2018 at 7:22
  • @Fabrizio - yes, browser does show credential request on localhost, and behavior is the same on the remote server. Dev server is in another domain, but still it seems to work fine in such configuration. In my mind the problem should be on caller's side since the user does get authenticated on IIS... It's just wrong user. Mar 27, 2018 at 12:12
  • @Fildor - let me put it this way: I compared every setting I was able to find, but of course it does not guarantee that I didn't miss something. And win auth seems to work even though the user is wrong, so IIS settings should be ok... but there's no guarantee to that either :) Mar 27, 2018 at 12:17

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.