asp.net mvc - .net core and kestrel - best practices for using IIS as an intermediary for Windows Authentication? -
i'm interested in porting .net mvc app .net core mvc , using kestrel webserver.
i know kestrel doesn't support windows authentication, can suggest ideas on using iis intermediary wa?
for example, user hits page on iis server check credentials -> page sends aes encrypted key specific user/domain info kestrel server page verify identity. maybe fetching information through ajax call work too.
does example seem reasonable performance/security point?
i decided go ahead , build by:
1) building net core app on iis windows authentication enabled,
2) passing aes encrypted string user information + other information via url kestrel server core apps,
3) core apps decrypt key, check if still valid , user info valid.
4) pass encrypted string tempdata cookie , reload url without string user not see of url garbage.
this seems work well, , user doesn't see indication via url of kind of authentication string, able use number of kestrel servers independent of iis, using iis windows authentication needed.
Comments
Post a Comment