Search code examples
asp.net-coreiiswindows-authentication

ASP.NET Core Windows Authentication pass through from UI website to API

IIS on Windows Server 2012 setup with 2 projects:

  • example.com: ASP.NET Core MVC project with VueJS as javascript framework.
  • api.example.com: ASP.NET Core Web API project whichs feeds the UI project.

The example.com is setup using Windows Authentication, the api.example.com is setup with both Anonymous and Windows Authentication.

Both projects have a seperated Application Pool.

Everything is working fine except when I go to the example.com website, I get a prompt to input my AD credentials for example.com, after that I get another one for api.example.com.

So the user needs to enter his credentials twice. Is there a way to reduce this to one and send the credentials to both websites?

I am using Google Chrome as browser to use the website.

Solution

  • Ok reduced the login to zero. Disabled the Windows authentication on the example.com because all authentication is done on the API project so no need to apply it here. Then added the api.example.com under Internet Explorer > Settings > Security > Intranet sites and kow the client can work directly without applying credentials when working inside the domain.