How to enable Windows authentication for specific controller in ASP.Net Web API

Question

I was wandering if there is a way to enable Windows authentication only for the particular action of the particular ASP.Net Web API controller. My Web API web service has a couple of controllers with numerous actions, but only one action of one controller needs Windows authentication. This web services is implemented using Web API 2.1, and is hosted in IIS (v7.5 and above). Even though, it’s an intranet web service I don’t want to enable windows authentication on controllers and actions that don’t need it. Please let me know if there is a way to enable Windows authentication for a specific controller and action.

My web service code is similar to the code below. Only endpoint api/controller1/action1 implemented by Controller1.Action1 requires windows authentication. The rest of actions don't need Windows authentication:

[RoutePrefix("api/controller1")]
public class Controller1: ApiController
{
    [Route("action1")]
    public HttpResponseMessage Action1()
    {
        return Request.CreateResponse<object>(HttpStatusCode.OK, null);
    }
    [Route("action2")]
    public HttpResponseMessage Action2()
    {
        return Request.CreateResponse<object>(HttpStatusCode.OK, null);
    }
}


[RoutePrefix("api/controller2")]
public class Controller2 : ApiController
{
    [Route("action1")]
    public HttpResponseMessage Action1()
    {
        return Request.CreateResponse<object>(HttpStatusCode.OK, null);
    }
    [Route("action2")]
    public HttpResponseMessage Action2()
    {
        return Request.CreateResponse<object>(HttpStatusCode.OK, null);
    }
}

Thank you, Rita

I have the same requirement. Did you figure out how to do this? — Arshad Mohammad
– Arshad Mohammad, Commented Apr 11, 2017 at 18:39
I went with a deployment time solution instead. I used appcmd.exe tool to enable Windows authentication for a route: C:\Windows\system32\inetsrv\appcmd.exe set config "baseUrl/api/controller1/action1" -section:system.webServer/security/authentication/windowsAuthentication /enabled:"True" /commit:apphost — Rita Feldman
– Rita Feldman, Commented Apr 12, 2017 at 20:23

7284 · Accepted Answer · 2014-09-16 06:27:37Z

3

is this what your want? adding this to your config file.

<location path="api/controller1">
  <system.web>
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>
</location>

answered Sep 16, 2014 at 6:27

7284

967 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 11:46:57Z

0

I had the same problem. The solution was

Enable Windows Authentication in IIS Website, where your API is hosted. If you are using OWIN to self host, see this SO discussion
Then in your controller or controller action, which requires Windows Authentication, just add an "Authorize" attribute.

[Authorize] public async Task GetDocumentContent([FromUri]DocumentContentRequest request) {

}

That is it.

edited May 23, 2017 at 11:46

CommunityBot

11 silver badge

answered Apr 21, 2017 at 19:10

Arshad Mohammad

4094 silver badges7 bronze badges

Collectives™ on Stack Overflow

How to enable Windows authentication for specific controller in ASP.Net Web API

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related