Windows Authentication using Blazor with .Net Core WebApi

2
votes

I have the task to develop a Blazor Webassembly App. This app is only used within the companys network and for security reasons we would like to use the existing AD and NTLM Authentication.

So far I have a minimal Blazor App configured and running in IIS. Its configured to use Windows Authentication and that works so far. When I open the app in Browser I get asked for my credentials. The app should also communicate with a .net core webapi which is also secured by windows authentication. This webapi security too works as it should. When I open an URL to it in Browser I get asked for my credentials and the page loads as it should.

Now the Problem: When I call the same url (that works in Browser) from my Blazor app with HttpClient.GetAsync I get an "401: Not Authorized" error. Even though the app itself is loaded with the same authentication. Is there something I have to do? The MSDN Documenations a gigantic and I couldnt find a Solution.

In the WebApi Startup.cs in ConfigureServices() I added

services.AddAuthentication(IISDefaults.AuthenticationScheme);
services.AddAuthorization();

and in Configure()

app.UseCors(x => x.AllowAnyMethod().AllowAnyHeader().SetIsOriginAllowed(origin => true).AllowCredentials());
app.UseAuthentication();
app.UseAuthorization();

PS: The Blazor App uses .NET Core 3.1 The WebApi uese .NET 5.0

2
asp.net-coreauthenticationasp.net-web-api.net-coreblazor
Is there an authentication header in the request? - Jan Bejvl
According to Firefox there is nothing within the header that looks anything like authentication. That helps. But how do I get it there the (correct?) way? - Saga

2 Answers

0
votes

I recommend checking Blazor WebAssembly additional security scenarios (all the examples are there)

To authorize your request, you can use HttpClient with BaseAddressAuthorizationMessageHandler:

builder.Services.AddHttpClient("ServerAPI", 
    client => client.BaseAddress = new Uri("https://www.example.com/base"))
.AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();

BaseAddressAuthorizationMessageHandler will automatically add Authorize header to all outgoing requests.

Note: This works only with Blazor Wasm, not Server.

0
votes

When injecting HttpClients via IHttpClientFactory, you can register a named HttpClient that uses windows auth like so:

services.AddHttpClient("Excit", x =>
{
    //other settings
}).ConfigurePrimaryHttpMessageHandler(() =>
{
    return new HttpClientHandler
    {
        UseDefaultCredentials = true
    };
});