Authorization header always missing about pysco68.owin.authentication.ntlm HOT 8 CLOSED

Hello Josh, I'll look into your issue in the next days, I was on vacation the last month, so sorry for the delay!

from pysco68.owin.authentication.ntlm.

No worries about the delay! I appreciate you giving things a look though. Sadly I couldn't ever get things working. Haha I tried just about everything. Nothing looked out of place while stepping through either.

from pysco68.owin.authentication.ntlm.

Hi again Josh,

I looked at the code you provided, and on a first sight it looks perfectly right to me. Still I see some possible issues, so let me ask some questions. The first one I have is, what are you hosting your OWIN application in? If it is IIS (or any HTTP server/proxy in front of your application) have you made sure it does not process the NTLM/Kerberos stuff? (this answers your question about the Windows Authentication setting in the project; it should be off, as this is just a UI tuning some of the environments settings)

from pysco68.owin.authentication.ntlm.

I tested with both IISExpress (straight through VS) and a local IIS instance, and both ended up giving me the same results. And yeah, as you mentioned, there should never have been a need to enable Windows Authentication so I never did.

I should also mention that I did manage to get this working, albeit with a different library. https://www.nuget.org/packages/OWIN-MixedAuth/ to be specific. There was one thing that I did notice while setting that package up, though: It needed to be registered after any middleware that uses the PipelineState.Authenticate pipeline state as it relies on PipelineState.PostAuthenticate. I had to shuffle a few things around to get that working correctly. Do you think your library would need a similar disclaimer?

from pysco68.owin.authentication.ntlm.

Well I guess that in your application scenario using that other library is not a bad idea! In fact this OWIN middleware was designed with another case in mind that involved the impossibility to rely on either HttpListener (no WebSockets on Server 2008 R2) nor IIS (for other application specific policy).

I've used it successfully with both Nowin (which was the host I designed the library for) and Kestrel lately.
Btw. I never considered any IIS related things in the library as I was never meant to be used in conjunction with IIS (as both IIS and IISExpress support windows authentication on their own)

from pysco68.owin.authentication.ntlm.

Gotcha, gotcha. Makes sense! The reason we were exploring these sorts of avenues was mainly because we wanted to toggle each authentication provider. One setup may use SAML or OAuth while another chooses to use NTLM. Doing so restricts us from using IIS' Windows Authentication setting.

Thanks again for reaching out!

from pysco68.owin.authentication.ntlm.

You're welcome!

Regarding your requirement, sure, that makes sense! If I find some spare time in the next weeks I'll try to setup my lib behind IIS or IIS Ex for a few hours. If I find out anything I'll let you know!

In the meanwhile I'll close this issue if you don't mind(?)

from pysco68.owin.authentication.ntlm.

Nope not at all. In fact I'll do it for you ;)

Feel free to reopen though if you have any questions!

from pysco68.owin.authentication.ntlm.