I have an Asp Core page running on an IIS-Server. Until now I authenticate the users with Windows Authentication (NTLM). Now I want to use one part of the site as Api for an Android app. This part need anonymous authentification, but if I enable it for the whole site, the Windows users will be asked no more for their credentials.
Is there a way to enable the anonymous authetication only for some pages, respectively for a path in the site structure?
0
votes
At site level, it is always anonymous or Windows authentication, and you cannot have both. To save your time, set up an anonymous site for your Android clients.
- Lex Li
I was afraid to do this, but thanks.
- JonTravo
1 Answers
0
votes
I do it by putting [Authorize] on top of the method of my controller that require the user to be authenticated. The ones without the tag won't require authentication and will work well with IIS anonymous access.
Note: there is also a "AllowAnonymous" attribute (src: https://docs.microsoft.com/en-us/aspnet/core/security/authorization/introduction?view=aspnetcore-3.1#namespaces)
Note2: You can customize your [Authorize] attribute to use a specific authentication scheme as demonstrated here.
