Use Windows Authentication in Net Core 2.0

This link has everything we need: Configure Windows authentication in an ASP.NET Core app

About the launchsetting.json file

• See What is launchsetting.json in ASP.NET Core
• Windows Authentication and Anonymous Authentication can be set through IIS Authorization or launchsetting.json. However launchsetting.json only affects  development time (running through IIS profile) . Once deployed,  it's determined by IIS Authorization setting only.

If Windows Authentication is enabled but Anonymous is disabled

When Windows authentication is enabled and anonymous access is disabled, the [Authorize] and [AllowAnonymous] attributes have no effect.

The above description in Configure Windows authentication in an ASP.NET Core app is somehow wrong. In contrast, in a Intranet app where anonymous is disabled, there is no problem to still use [Authorize] to control access based on Windows groups. This pattern is common in real world.

Be aware cache issue when testing

For example, after adding/removing current user into/from TestGroup, we should close the browser and then reopen it to test the code. Chrome seems to show more cache issue. Use IE or Firefox for test.

Working code example

Required NuGet Package: Microsoft.AspNetCore.Authentication

Startup.cs

 public void ConfigureServices(IServiceCollection services) {

    ...

    services.AddMvc();

    services.AddAuthentication(IISDefaults.AuthenticationScheme);

    ...

}

BranchesController.cs

// Domain group

[Authorize(Roles = "Domain\\Domain Users")]

public class BranchesController : Controller    {

   // Local group

    [Authorize(Roles = "LocalComputerName\\TestGroup")]

    public async Task<IActionResult> Index()  {       

...

   }

    // Local group

    [Authorize(Roles = "TestGroup")]

    public async Task<IActionResult> Details(int? id) {

...

   }

}

How to get current user's login id?

Most web documents are talking about Asp.Net Core Identity that resumed Individual User Account is implemented rather than Windows Authentication. 

Note: Individual User Accounts is referring to ASP.NET Identity, https://softwareengineering.stackexchange.com/questions/284380/is-formsauthentication-obsolete. Asp.Net Core Identity is a self-contained membership and role provider authentication brought with Net Core for which the following links are helpful:

            // Migration from NET Core 1.0 to NET Core 2.0
            // https://docs.microsoft.com/en-us/aspnet/core/migration/1x-to-2x/identity-2x

            // Migration from ASP.NET MVC to NET Core 1.0

            // https://docs.microsoft.com/en-us/aspnet/core/migration/identity

             https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware?tabs=aspnetcore2x

However for our Intranet application, we use Windows Authentication instead.  Much simpler than thought, in my controller, the following line will return DOMAIN\userid

var userId = this.user.Identity.Name;

Note, you must disable Anonymous Authentication and enable Windows Authentication, else the returned userid might be null.

https://stackoverflow.com/questions/45987976/httpcontext-user-identity-not-set-when-not-using-iis-express