Implement Windows Authentication on ASP.NET Core Subpath

Learn how to configure Windows authentication to work on a specific subpath in your ASP.NET Core MVC application with our step-by-step guide.
---
This video is based on the question https://stackoverflow.com/q/68916846/ asked by the user 'Poul K. Sørensen' ( https://stackoverflow.com/u/871985/ ) and on the answer https://stackoverflow.com/a/68990701/ provided by the user 'Poul K. Sørensen' ( https://stackoverflow.com/u/871985/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to use Windows authentication on ASP.NET Core subpath only?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/licensing
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Implement Windows Authentication on a Specific ASP.NET Core Subpath

If you are developing an ASP.NET Core MVC application, you might find it necessary to implement Windows Authentication—not for the entire application, but only for specific subpaths. This setup can be a bit tricky, as you may encounter errors like "The Negotiate Authentication handler cannot be used on a server that directly supports Windows Authentication." In this guide, we will walk through the problem and provide a structured solution for configuring Windows Authentication on a designated subpath.

Understanding the Problem

When you try to configure Windows Authentication for a specific subroute in your ASP.NET Core application, you may face two primary issues:

Handler Error: You might encounter an error stating that the Negotiate Authentication handler cannot be used on your server, which directly supports Windows Authentication.

Unexpected Pop-ups: Even after resolving the above error, you might experience unexpected Windows authentication prompts appearing on every request.

To avoid these issues and set up Windows authentication correctly on a specific endpoint, you need to follow a structured approach.

Step-by-Step Solution

Here’s how you can configure Windows Authentication to work only on a specific subpath in your ASP.NET Core application.

Step 1: Modify the web.config File

To enable Windows Authentication, you need to ensure that the correct settings are in place in your web.config file. Here’s an example:

[[See Video to Reveal this Text or Code Snippet]]

This configuration allows Windows Authentication but will risk popping up on every request.

Step 2: Set Up Endpoint Routing

To specifically target the desired subpath, such as /testendpoint, we can use endpoint routing in ASP.NET Core with a custom endpoint. Here’s how to do that:

[[See Video to Reveal this Text or Code Snippet]]

Step 3: Create User and Claims Principal

You will need helper methods such as ExtractUserName, CreateOrUpdateUser, and CreateClaimsPrincipal. These should handle user information extraction and updating the database if needed.

Step 4: Configure Authentication Scheme

Finally, configure the authentication scheme in your ConfigureServices method:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

By following these steps, you can successfully configure Windows Authentication for specific subpaths in your ASP.NET Core application and avoid authentication prompts on every request. This setup allows for a cleaner and more controlled authentication experience, ensuring that only the necessary routes enforce Windows Authentication while the rest of your application can use other configured authentication methods.

Now you can implement this method and streamline your application authentication effectively!