Kerberos Authentication Question

[jruckert]

Hi,

A couple of questions:

1. Will the platform handler be able to support Kerberos Authentication?
2. Will we be able to configure CORS support (specifically the un-authenticated OPTIONS request, before hitting authentication - as per https://fetch.spec.whatwg.org/#cors-preflight-fetch)?

Cheers,
Jonathan

[Tratcher]

1. Yes it should, Kerberos is handled by the IIS native auth module. There shouldn't be any significant changes from how it works today with .NET 4.5.
2. After I implement Implement a full authentication handler #1 you'll be able to enable mixed auth (Anonymous & Negotiate/NTLM/Negotiate/Kerberos). This should allow you to process anonymous CORS requests but then require authorization for other endpoints like MVC controllers.

[jruckert]

Thanks @Tratcher for the information.

I am still a little bit confused about how you intend to implement/configure the mixed auth scenario.

Will we have to configure the authentication in both IIS and the middleware?

1. Configure IIS for both "Windows Auth" + "Anonymous" and,
2. Configure the middleware early on the piece to allow both "Windows" and "Anonymous".

Will there be a policy builder or something similar, so we can configure a couple of variants up front and then selectively decide based on which environment which policy to apply (similar to how CORS is setup)? I have a specific requirement on deploying the same code base (Web API's) but with different authentication options?

[Tratcher]

I plan to plug it into the existing authentication framework used in the aspnet/security repo. That framework separates authentication from authorization. This middleware will be responsible for authentication (e.g. getting you a windows identity), but then you'll use the authorization framework (e.g. the [Authorize] attribute and policies) to decide if that user gets access to specific content.