In a aspnet.core application I added the following middleware:
app.Use(async (context, next) =>
{
var authService = context.RequestServices.GetRequiredService<IAuthenticationService>();
AuthenticateResult result = null;
// Try JWT first
if (context.Request.Headers.ContainsKey("Authorization"))
{
result = await authService.AuthenticateAsync(context, JwtBearerDefaults.AuthenticationScheme);
}
// If JWT fails or wasn't present, try Windows
if (result == null || !result.Succeeded)
{
result = await authService.AuthenticateAsync(context, NegotiateDefaults.AuthenticationScheme);
}
if (result?.Succeeded == true)
{
context.User = result.Principal!;
}
await next();
});
I setup the Authentication Services like this:
services.AddAuthentication( options =>
{
options.DefaultAuthenticateScheme = NegotiateDefaults.AuthenticationScheme;
})
.AddNegotiate()
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = Configuration.GetValue<string>("TokenValidIssuer"),
ValidAudience = Configuration.GetValue<string>("TokenValidAudience"),
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration.GetValue<string>("SuperSecretKey")))
};
});
The app is hosted in IIS. The problem is that when I allow Anonymous Authentication in IIS together with the Windows one, the Windows Authentication in the middleware stops to work, the result is not authenticated. Can someone help me how to set the IIS?