3

I have a MVC 4.5 Website, and it is setup for Windows Auth as such:

<authentication mode="Windows" />
<authorization>
  <deny users="?" />
</authorization>

This seems to allow me to correctly display User.Identity.Name as "DOMAIN\username"

Which means, that this code on the controller should work:

[Authorize(Users = @"DOMAIN\username")]
public class TestController : Controller
{...}

However, when this is added, all of the pages in the controller will cause both IE and Chrome to prompt over and over for the login info. There doesn't seem to be any way to 'login' to the application!

If I add [Authorize] then it does not prompt over and over.

I can make it work by doing:

if (user.Identity.Name != @"DOMAIN\username")  return NotAuthorized();

at the start of each method... but if Identity is set correctly, why can't it use it?

I have this problem running locally under Visual Studio, as well as running on an iis site.

Project Properties

PS: Before someone flags this as a duplicate, please make sure it really is - I've not been able to find anything failing this way.

------ Update: OK, I think I figured this out... I used a [Authorize(Roles="Everyone")] And it worked (Yeah, we really have that role), So, I thought I'd try setting it to an invalid group, EveryoneX. This caused it to prompt - I guess to allow you to change to another user that has access. (I was expecting it to redirect to the unauthorized page directly.)

So, I double-checked, and there was a typo on the Users="OUR_DOMAIN\username" - should have been "OUR-DOMAIN\username" It now seems to be working as it should be. I can't believe that I missed that for that long.

Thanks for everyone who helped me find this.

3
  • If you breakpoint your code, and check user.Identity.IsAuthorised you'll probably see it is false. So it knows the user but that user hasn't been authorised.
    – NibblyPig
    Mar 20, 2017 at 16:02
  • @stuartd As he is asking that He can make it work as "if (user.Identity.Name != @"DOMAIN\username")" it's mean windows authentication is fine Mar 20, 2017 at 16:06
  • Yes, the user.Identity.IsAuthenticated = True. The only thing that I can think of is that there is a '-' in our domain name. 'OUR-DOMAIN' - is that getting MVC confused? ( Mar 20, 2017 at 16:10

1 Answer 1

0

Check this on your web folder property is it same on your visual studio? enter image description here

The other thing is that. Windows authentication works with Roles like:

[Authorize(Roles = @"DOMAIN\ADGroup")]
public class TestController : Controller
{...}

OR

var User = System.Web.HttpContext.Current.User;
            if (User.IsInRole("DOMAIN\\ADGroup"))
            {
                return RedirectToAction("UnAuthorized");
            }
4
  • Yeah, that is the settings (Per the web.config example - all the UI does is flip the flags in the web.config) Mar 20, 2017 at 16:11
  • You need to authorize with Active Directory Group like i've done above in my answer Mar 20, 2017 at 16:24
  • The highlighted values match my configuration. Mar 20, 2017 at 16:28
  • then try with "[Authorize(Roles = @"DOMAIN\ADGroup")]" I've edited my answer Mar 20, 2017 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.