[WinAuth] Lack of Detail: [Authorize] attribute requires additional configuration in Startup.cs

[rbonomo]

In ASP.NET Core 2.x, the [Authorize] attribute requires additional configuration in Startup.cs to challenge anonymous requests for Windows Authentication. The recommended configuration varies slightly based on the web server being used.

Describe this

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 401ad9a0-9e51-80a2-5846-82e9790d7257
• Version Independent ID: fbc36c26-9992-1f4c-66d3-02f898ee7ec4
• Content: Configure Windows Authentication in ASP.NET Core
• Content Source: aspnetcore/security/authentication/windowsauth.md
• Product: aspnet-core
• Technology: aspnetcore-security
• GitHub Login: @scottaddie
• Microsoft Alias: riande

[guardrex]

Hello @rbonomo ... AFAIK, that line refers directly to the following two sub-sections: IIS and HTTP.sys. AFAIK, it doesn't mean that there's more to say than what you see next.

@Tratcher is there anything else to say there? Here's the section under discussion ...

https://docs.microsoft.com/aspnet/core/security/authentication/windowsauth?view=aspnetcore-2.2&tabs=visual-studio#allow-anonymous-access

[EDIT] Yes ... even if my hunch is correct ... I see some opportunities here to improve the language. I'm going to schedule this for at least some minor updates.

[Tratcher]

The key addition people usually overlook is services.AddAuthentication(IISDefaults.AuthenticationScheme);

[guardrex]

The language is a little 😵 scatter brained 😵 leading into the server code examples that follow ... it sounds exactly like @rbonomo described it ... like there's something else ... something not explained. I'll address it. Thanks @rbonomo. 🚀

[xr280xr]

The key addition people usually overlook is services.AddAuthentication(IISDefaults.AuthenticationScheme);

It would be helpful if it also outlined what this line does/why it is necessary for Windows auth. If windows auth is enabled/disabled in IIS directly, what does this do? Also whether this line limits the app strictly to an IIS deployment. I couldn't find a description of this extension method.

[Tratcher]

Comments on closed issues are not tracked, please open a new issue with the details for your scenario.