Is it possible to have Windows Authentication AND Individual User Accounts (Anonymous Authentication) in 2.2?

Is your feature request related to a problem? Please describe.

We are wanting to build multiple web apps, and furthermore, we’re wanting to create a Single Sign-On app so that it’s easy for our employees to use.

Most of our apps will be used only internally, therefore Windows Authentication would be the easiest. However, certain apps over time (or initially) will need to allow outside users.

In launchSettings.json, we have this:

"iisSettings": {
    "windowsAuthentication": true, 
    "anonymousAuthentication": true, 
    "iisExpress": {
      "applicationUrl": "http://localhost:3833",
      "sslPort": 44375
    }

If you have Windows Auth as true, and anonymous as false, then in the code, User.Identity.Name shows the user logged in.

However, as soon as you enable anonymousAuthentication (i.e.: set to true), then it never sees the logged in Windows User anymore.

I cannot find documentation anywhere.

Describe the solution you’d like

Presuming I can enable both, I would like essentially to do the following:

Be able to write a conditional statement. On load of the app: (Pseudo code):

IF User.Identity.Name is not null or empty (so Windows Authenticated)
THEN do something (in my case I want to send a bearer authentication token via httpOnly cookie).
ELSE provide a login form (in my case, this must be an External User, and I want them log in with Username + Password)

Describe alternatives you’ve considered

Option 1: Create 2 Different Apps. One for Windows Auth, One for Anonymous Auth

Option 2: Use a Third Party Authentication app. But this costs money.

Additional context

Personally, I’m relatively new to C# and .Net world. Started about 6 months ago. Now, I’ve learned a lot but if you provide solutions, can you use the K.I.S.S. principle? That is: “Keep It Stupid Simple”. Can you give specific steps such as "Go to your Startup.cs file, within your Configure method and add ______ just below app.UseCookiePolicy(), and paste this: ____, etc.

Many thanks!

[brockallen]

IdentityServer might be a good candidate for this. Our templates have both password and windows auth.

[blowdart]

Not easily, and not in a supported way. You could, if you knew the IP addresses of the intranet, attempt to trigger Windows auth on those requests, but that seems rather unsafe.

Third party auth doesn’t have to cost, you may be able to do it with identity server, by taking the approach above. I’d ask them.