Скачать или смотреть Implementing Windows Authentication on IIS with Node.js

Discover how to configure IIS to intercept HTTPS requests, authenticate users with Windows Authentication, and proxy requests to Node.js while passing user and role information.
---
This video is based on the question https://stackoverflow.com/q/66379549/ asked by the user 'geeko' ( https://stackoverflow.com/u/158851/ ) and on the answer https://stackoverflow.com/a/66381782/ provided by the user 'Bruce Zhang' ( https://stackoverflow.com/u/14162739/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Windows Authentication on IIS and Proxy to Node with User/Roles in Header?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Implementing Windows Authentication on IIS with Node.js: A Step-by-Step Guide

If you're running a web application that combines Internet Information Services (IIS) with Node.js on a Windows Server, you might be wondering how to securely authenticate users and manage their roles effectively. Specifically, the challenge arises when you want to use Windows Authentication to intercept HTTPS requests before passing them to your Node.js application, ideally including user details and security groups in the process.

In this guide, we will break down the solution to this problem into clear, actionable steps. Let's dive in!

Understanding Windows Authentication

Windows Authentication is an authentication method that verifies users through the local Windows network. It utilizes protocols like NTLM (NT LAN Manager) and Kerberos (Negotiate) to ensure that users are properly authenticated based on their Windows credentials. When configured correctly, it seamlessly integrates with IIS to provide a robust authentication framework.

The Challenge

In this scenario, the key challenge is ensuring that IIS can:

Intercept HTTPS requests.

Authenticate users using Windows Authentication.

Proxy these requests to a Node.js application as HTTP requests.

Include this user's username and security group information within the request headers sent to Node.js.

The Solution

While this might seem like a daunting task, it is indeed possible to achieve this with the right configuration. Here’s how to set it up:

Step 1: Configure Windows Authentication on IIS

First, ensure that IIS has Windows Authentication enabled:

Open IIS Manager on your Windows Server.

Select your site, and double-click on the Authentication feature.

Disable Anonymous Authentication.

Enable Windows Authentication.

Step 2: Set Up URL Rewrite and ARR

In order to proxy requests to your Node.js application, you need to set up the Application Request Routing (ARR) and configure URL Rewrites. Here’s a simple guide:

Install ARR:

Use the Web Platform Installer to install the Application Request Routing module for IIS.

Enable Proxy:

Open the Server Manager, and go to the IIS section.

Click on the Server Proxy Settings and enable proxy.

Create a URL Rewrite Rule:

Go back to IIS Manager, select your site, and open the URL Rewrite feature.

Click on Add Rule(s) and choose Blank Rule.

Configure your rule to route requests to your Node.js application endpoint.

Step 3: Pass User and Security Group Information

Now comes the crucial part of passing user data to your Node.js application. However, it's important to note that by default, IIS might not retrieve user names and security group information. To facilitate this:

You might require an ASP.NET application as an intermediary. The ASP.NET application can make use of HttpContext to access the authenticated user’s details.

Capture the username and security groups within the ASP.NET application, then forward these details in the HTTP headers to your Node.js application.

Example of Adding Headers in ASP.NET

Here's a simplistic example of how you might add headers in your ASP.NET application:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

Integrating Windows Authentication with IIS and Node.js allows for a seamless, secure experience when managing authenticated users. By following the steps listed above, you can effectively set up your environment to handle HTTPS requests through IIS, utilize Windows Authentication, and pass essential user and role information to Node.js applications for processing.

Feel free to reach out in the comments if you have any questions or if something isn’t working as expected!