asp net core 3.1 angular windows authentication required username and password

Question

i'm using asp net core 3.1 with angular i want to combine windows authentication and JWT for canactivate in angular while routing and authorize the controller but always required windows username and password while i pass the token from interceptor to the controller

request.clone({ headers: request.headers.set('Authorization', 'Bearer ' + user.token) });

my launchSettings.json change to below

"windowsAuthentication": true,
"anonymousAuthentication": false,

add below code to the startup ConfigureServices

var appSettingsSection = Configuration.GetSection("AppSettings");
            services.Configure(appSettingsSection);

            // configure jwt authentication
            var appSettings = appSettingsSection.Get();
            var key = Encoding.ASCII.GetBytes(appSettings.Secret);
            services.AddAuthentication(x =>
            {
                x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(x =>
            {
                x.RequireHttpsMetadata = false;
                x.SaveToken = true;
                x.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(key),
                    ValidateIssuer = false,
                    ValidateAudience = false
                };
            });

add below code to the startup Configure

app.UseAuthentication();
app.UseAuthorization();

user_11129547 · Answer

You can hardly combine windows and jwt token authentication if you are hosting your application on IIS. Both JWT and Windows authentication utilize the Authorization header in Http Request Header, but IIS takes it over first, when your request is a JWT request, the Authorization header you sent is some like this

Authorization: Bearer {jwtcontent}

Then iis windows authentication module takes over your request and found it can not recognize your Authorization header, so it responses to your request with 401 and a Authorization header like this(Negotiate)

Authorization: Negotiate YIIg8gYGKwY[...]hdN7Z6yDNBuU=

or (for NTLM)

Authorization: NTLM TlRMTVN[...]ADw==

Your browser receives this response and found server is looking for a windows credential so it pops up a windows asking you to type in your username and pwd

All of these are handled by IIS and Browser, it does not even goes to your application code.

asp net core 3.1 angular windows authentication required username and password

1 Answers