{"id":1293,"date":"2010-05-10T13:26:56","date_gmt":"2010-05-10T13:26:56","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/odatateam\/2010\/05\/10\/odata-and-authentication-part-2-windows-authentication\/"},"modified":"2018-09-04T18:01:01","modified_gmt":"2018-09-04T18:01:01","slug":"odata-and-authentication-part-2-windows-authentication","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/odata\/odata-and-authentication-part-2-windows-authentication\/","title":{"rendered":"OData and Authentication \u2013 Part 2 \u2013 Windows Authentication"},"content":{"rendered":"

Imagine you have an OData Service installed on your domain somewhere, probably using the .NET Data Services producer libraries, and you want to authenticate clients against your corporate active directory.<\/p>\n

How do you do this?<\/p>\n

On the Serverside<\/h3>\n

First on the IIS box hosting your Data Service you need to turn on integrated security, and you may want to turn off anonymous access too.<\/p>\n

\"TurnOnIntegratedSecurity\"<\/a> <\/p>\n

Now all unauthenticated requests to the website hosting your data service will be issued a HTTP 401 Challenge. <\/p>\n

For Windows Authentication the 401 response will include these headers:
WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate<\/font><\/p>\n

The NTLM header means you need to use Windows Authentication. <\/p>\n

The Negotiate header means that the client can try to negotiate the use of Kerberos<\/a> to authenticate. But that is only possible if both the client and server have access to a shared Kerberos Key Distribution Centre<\/a> (KDC).<\/p>\n

If, for whatever reason, a KDC isn\u2019t available a standard NTML handshake<\/a> will occur.<\/p>\n

Detour: Basic Authentication<\/font><\/h4>\n

While we are looking into Windows Authentication it is worth quickly covering basic auth too because the process is very similar.<\/font><\/p>\n

When you configure IIS to use Basic Auth the 401 will have a different header:
WWW-Authenticate: Basic realm="mydomain.com"<\/font><\/font><\/p>\n

This tells the client to do a <\/font>Basic Auth handshake<\/font><\/a> to provide credentials for ‘mydomain.com’. The \u2018handshake\u2019 in Basic Auth is very simple \u2013 and very insecure \u2013 unless you are also using https.<\/font><\/p>\n

On the Clientside<\/h3>\n

Now that a NTLM challenge has been made, what happens next?<\/p>\n

In the browser:<\/h4>\n

Most browsers will present a logon dialog when they receive a 401 challenge. So assuming the user provides valid credentials they are typically free to start browsing the rest of site and by extension the OData service.<\/p>\n

Occasionally the browser and the website can "Negotiate" and agree to use kerberos, in which case the authentication can happen automatically without any user input.<\/p>\n

The key takeaway though is that in a browser it is pretty easy to authenticate against a Data Service that is secured by Windows Authentication.<\/p>\n

.NET Client Application:<\/h4>\n

In a .NET client application using the standard .NET Data Services client \u2013 or for that matter the open source version<\/a> \u2013 you need to tell data services your credentials.<\/p>\n

Which you do like this:<\/p>\n

MyDataContext ctx = new MyDataContext(uri);
ctx.Credentials = System.Net.CredentialCache.DefaultCredentials; 
<\/font>
The example above makes sense if your client application is running under a windows account that has access to the server. If not however you will have to create a new set of NetworkCredentials and use them instead.<\/p>\n

ctx.Credentials = new NetworkCredential(
    "username",
    "password",
    "domain");<\/font><\/p>\n

As you can see, pretty simple.<\/p>\n

Silverlight Client Application:<\/h4>\n

Silverlight on the other hand is a little different. <\/p>\n

If it is running in the browser \u2013 the only option in SL2 & 3 – then by default the Data Services client will re-use the cookies and authentication headers already established by the browser. <\/p>\n

Silverlight 2 & 3:<\/h5>\n

In fact in Silverlight 2 & 3 that is all it can do. The Silverlight client library doesn\u2019t have a Credentials property so there is no way to use different credentials.<\/p>\n

Typically if your SL app is hosted by a site that requires Windows Authentication, you don\u2019t have a problem \u2013 because in order to download the Silverlight app, you need to authenticate in the browser first.<\/p>\n

Which means from the perspective of the Data Service you are already authenticated.<\/p>\n

Warning:<\/u><\/strong> While it is possible in Silverlight to do x-domain calls, so long as the other domain has a correctly configured ClientAccessPolicy.xml<\/a> file, if the other domain needs you to logon, there is no way to provide your credentials.<\/p>\n

Silverlight 4:<\/h5>\n

Silverlight 4 is significantly more flexible, because it adds a Credentials property to the DataServiceContext. Which you can use to provide a different set of credentials if required.<\/p>\n

In fact, if you think about it, because SL4 can run ‘out of browser’ the ability to set credentials directly is absolutely vital.<\/p>\n

Despite this new feature in SL4 there are still some differences between .NET and SL4. <\/p>\n

In SL4 there is no CredentialsCache so you can\u2019t re-use the DefaultCredentials from the client. However we added a very handy property instead:<\/p>\n

ctx.UseDefaultCredentials = true;<\/font><\/p>\n

Summary:<\/h4>\n

As you can see using Windows Authentication with OData is pretty simple, especially if you are using the Data Services libraries. <\/p>\n

But even if you can\u2019t, the principles are easy enough, so clients designed for other platforms should be able to authenticate without too much trouble too.<\/p>\n

Next time out we\u2019ll cover a more complicated scenario involving OAuth.<\/p>\n","protected":false},"excerpt":{"rendered":"

Imagine you have an OData Service installed on your domain somewhere, probably using the .NET Data Services producer libraries, and you want to authenticate clients against your corporate active directory. How do you do this? On the Serverside First on the IIS box hosting your Data Service you need to turn on integrated security, and […]<\/p>\n","protected":false},"author":512,"featured_media":3253,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[15,48,67],"class_list":["post-1293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-odata","tag-authentication","tag-odata","tag-silverlight"],"acf":[],"blog_post_summary":"

Imagine you have an OData Service installed on your domain somewhere, probably using the .NET Data Services producer libraries, and you want to authenticate clients against your corporate active directory. How do you do this? On the Serverside First on the IIS box hosting your Data Service you need to turn on integrated security, and […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts\/1293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/users\/512"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/comments?post=1293"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts\/1293\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/media\/3253"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/media?parent=1293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/categories?post=1293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/tags?post=1293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}