Is it possible to use signed-in windows user credentials to authenticate to web API?

user_986533 0
Viewed 238

I am implementing authentication for a command line client application that makes a web request to a web API. If I reason correctly, I can apply Azure Active Directory native app authentication scenario.

My concern here is that setting up Azure AD will require significant effort from the client app users on setting up AAD, plus they will have to work with an interactive dialog. This gets even worse in case no human is present, as the service to service scenario is even more complicated.

Is it possible to instead rely on the credentials of the signed-in user of the client computer? Assume Windows-based client machine that is joined to a domain, say FooDomain. The server uses an OWIN-based self-host implementation, Katana.

Related questions:
OWIN Web API Windows Service - Windows Identity Impersonation

azure-active-directory azure windows-authentication authentication windows
1 Answers

@Konrad Jamrozik. IF you are working on .NET and want to use the logged-in user in Windows domain joined (your case), and even AAD joined, my advice would be to use MSAL.NET with the Integrated Windows Authentication (IWA) override. See https://aka.ms/msal-net-iwa. The simplified code looks like this:

string authority = "https://login.microsoftonline.com/contoso.com";
string[] scopes = new string[] { "user.read" };
PublicClientApplication app = new PublicClientApplication(clientId, authority);
var accounts = await app.GetAccountsAsync();

AuthenticationResult result=null;
if (accounts.Any())
{
 result = await app.AcquireTokenSilentAsync(scopes, accounts.FirstOrDefault());
}
else
{
  result = await app.AcquireTokenByIntegratedWindowsAuthAsync(scopes);
}

This sample explains how to register the app and provides all the details about the code: https://github.com/azure-samples/active-directory-dotnet-iwa-v2

user_62251040
Related