asp.net mvc - .net core and kestrel - best practices for using IIS as an intermediary for Windows Authentication? -


i'm interested in porting .net mvc app .net core mvc , using kestrel webserver.

i know kestrel doesn't support windows authentication, can suggest ideas on using iis intermediary wa?

for example, user hits page on iis server check credentials -> page sends aes encrypted key specific user/domain info kestrel server page verify identity. maybe fetching information through ajax call work too.

does example seem reasonable performance/security point?

i decided go ahead , build by:

1) building net core app on iis windows authentication enabled,

2) passing aes encrypted string user information + other information via url kestrel server core apps,

3) core apps decrypt key, check if still valid , user info valid.

4) pass encrypted string tempdata cookie , reload url without string user not see of url garbage.

this seems work well, , user doesn't see indication via url of kind of authentication string, able use number of kestrel servers independent of iis, using iis windows authentication needed.


Comments

Popular posts from this blog

ios - MKAnnotationView layer is not of expected type: MKLayer -

ZeroMQ on Windows, with Qt Creator -

unity3d - Unity SceneManager.LoadScene quits application -