Where does CreateDomainAuthenticationProperties get the login information?

[Stephen_Houston]

Hyland DLL version 16.0.0.20

We're using MVC and Windows Authentication.  When we call Application.CreateDomainAuthenticationProperties and connect using the returned variable, it returns with a 401 unauthorized. 

The credential being used is the AppPoolCredential, which for us is NetworkService.  I would expect it to use the currently logged in Windows user, but we can't figure out how to get those credentials to pass through.

Any guidance on authenticating in this fashion is greatly appreciated.

[Alex_French · Accepted solution]

Stephen,

In the IIS Manager GUI, find your app and view the "Authentication" pane.

Right click on "ASP.NET Impersonation" and "Enable".

Right-click on "ASP.NET Impersonation" again and "Edit"... and in the "Edit ASP.Net Impersonation Settings" dialog make sure "Authenticated User" is selected.

If "ASP.NET Impersonation" is not in the list with [Anonymous Authentication, Basic Authentication, Forms Authentication, and Windows Authentication] in the Authentication pane, you may need to install or enable a Role Service.  Glancing at one of our IIS servers I don't think there is a separate Role Service that you don't already have if you're running an MVC application and using Windows Auth.

[Alex_French]

I should add- if your MVC IIS appplication is not running on the same server as the AppServer IIS application, then there's a whole different set of things you might need to do to solve the "double hop" problem (easily googleable, solveable, but not easy to solve as far as I know).

[Brian_Kavitz]

So if I'm interpreting your double hop comment correctly, the MVC app needs to reside on the same IIS instance as your OnBase AppServer for Domain Authentication to work in that scenario?

[Alex_French]

@Brian- that is definitely the easy option!

I think there are other options that involve Domain-level configuration of trust between specific machines, and maybe other options using Kerberos in the NTLM auth between the MVC app and the AppServer instance- but I haven't fully implemented those. Same IIS instance just works.