Member Avatar for berserk

I haver an IIS server with an mvc 5 app im developing and i have had no luck so far getting the windows authentication working with my app, i have it set to windows authenication but the app will only auto login users when accessed from the server. Then once you click logout it will prompt you for a username and password which is right and log you in accordingly, good so far, but then when you go to log out of that user you are not prompted but just reset back to the default local user of the computer which is NOT what i need.

I want the user to have to login to access the app, then when they click logout they are met with a log in screen, an di want the username and password to be the useranem and password one would you to access the current network they are on. So far i have only part of this but it isnt right. I believe the error code the login is returning is the whole reason im even able to switch users to begin with because it takes you to the error page no matter if you are a user or not, this is definitly wrong.

Is there additional code i need to put in for my account controller to be able to prompt for a windows login correctly without this mess i have.

If any code is needed ill glad post, just really looking for any resources that could lead me to the answer im seeking at the moment.

thanks a bunch!

  • 2 Contributors
  • 1 Reply
  • 324 Views
  • 18 Minutes Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Short summary for (and following 's Single‑Sign‑On hint): the behaviour is expected with Integrated Windows Authentication (IWA). Browsers on intranet machines will silently send the logged‑in Windows credentials (Kerberos/NTLM), so the server never gets a chance to “log out” a user in the web sense — the client just resends a valid credential and the session is re‑established. See Microsoft’s IWA overview. (learn.microsoft.com)

Three practical directions (tradeoffs noted):

  • Switch to a web login (Forms) that validates against AD. This gives full control over sign‑in and sign‑out. Example: validate credentials with PrincipalContext.ValidateCredentials(...) and then issue a forms auth ticket/cookie using FormsAuthentication (always use HTTPS / LDAPS for the validation step). See the PrincipalContext reference and the Forms Authentication overview. (learn.microsoft.com)

  • If Windows auth must stay, a common but imperfect trick is to force a 401 once so the browser will show a credential prompt (or fall back to the browser login dialog). That can be done from an MVC action (store a session flag so the 401 is only sent once). This works in some browsers/environments but is not a reliable “logout” for integrated SSO. Example pattern:

    [Authorize]
public ActionResult Index()
{
    if (Session["Sent401"] == null)
    {
        Session["Sent401"] = "yes";
        return new HttpUnauthorizedResult(); // 401 to trigger browser prompt
    }
    // normal rendering
}

    The technique and caveats are documented in community answers and IIS docs. (stackoverflow.com)

  • If a dialog is required every visit, enable Basic auth on the site (only over HTTPS). Basic forces credential prompts but sends credentials in cleartext unless protected by TLS; it’s a viable pragmatic workaround. (learn.microsoft.com)

Checklist for diagnosing the current setup: confirm IIS Authentication settings (Anonymous off, Windows on), provider order (Negotiate vs NTLM), Extended Protection / kernel‑mode settings, SPNs/Kerberos config if using Negotiate, and inspect IIS logs for 401.x substatus to see the exact failure reason. IIS status/substatus docs explain how to read those logs. (learn.microsoft.com)

Core recommendation: if true login/logout behavior (and switching users without closing the browser) is required, move to a web‑based auth flow (forms/OAuth/SAML/ADFS) that is designed for session control; IWA is intentionally designed for seamless OS-level SSO, not web logout. (learn.microsoft.com)

Member Avatar for rproffitt

Minor mispellings and typos mean I might not get what is happening here.

One of the Microsoft "things" also known as an overriding concept (some will write it's overreaching) is Single Signon. This means when I sign onto my PC then if all is setup right I don't need to sign on again for a Microsoft server or resource.

But that may or may not be what's going on here. But the small typos mean I may not understand what you are seeing.

Tell more.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.