xplat Integrated Windows Authentication (ntlm/Kerberos)

[Eilon]

From @evil-shrike on January 25, 2018 12:41

I haven't found any ticket for tracking the xplat Windows-auth support in aspnet/dotnet core.
I understand that currently we have only out-of-the-box Windows auth support in IIS/IISExpress and http.sys and only on Windows.

There's a decent article in docs https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?branch=pr-en-us-3622&tabs=aspnetcore2x on how to configure Windows auth. But it says nothing about non-Windows use-cases.

There're many issues here on Github and questions around on sites like SO on "how to implement Windows authentication in aspnet core on Linux". But all issues are closed with reasoning like "Kestrel doesn't implement Windows auth currenly, use IIS or https.sys". This is understandable but it's unclear what to do if we need to host an app on Linux and support integrated Windows auth (in intranet networks).

So there are several points which need to be addressed:

• what options do exist currently (at the time of 2.0/2.1) for getting integrated Windows authentication on Linux and other *nix OSes?
• what are plans (if any) for improving/adding such functionality?

I understand that strictly speaking this issue is related to Kestrel project probably, but it's more easily to find it here though. Moreover it's implementation details where Windows-auth support should live.

Anyway it should be some source of information describing what to do with aspnet core apps on Linux for adding Windows auth.

Some additional info:

• middleware for ntlm support - https://github.com/OneBitSoftware/Microsoft.AspNetCore.Authentication.ActiveDirectory (ntlm only, Windows only - "Achieving server-side NTLM handshaking depends the Windows platform due to interop, dependency on domain-joined machines and secur32.dll")
• it's possible to authenticate via Kerberos on Linux - https://technet.microsoft.com/en-us/library/2008.12.linux.aspx
• there's Application Proxy with Kerberos Constrained Delegation in Windows Server and Azure AD which seems to solve such problems - https://blogs.technet.microsoft.com/applicationproxyblog/2015/09/21/all-you-want-to-know-about-kerberos-constrained-delegation-kcd/ but it's complex
• there're modules for Nginx (http://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm) (requires commercial license) and Apache httpd (http://adldap.sourceforge.net/wiki/doku.php?id=mod_auth_ntlm_winbind) (it's unclear how stable it is) to add ntlm support
• It seems that Java has Kerberos support out-of-the-box - https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/single-signon.html
• Java implementation for app servers - http://spnego.sourceforge.net/ (not sure how it relates to the previous point)

Copied from original issue: #2824

[Eilon]

From @davidfowl on January 25, 2018 15:23

We don't have any plans AFAIK to support windows authentication when running on linux. There were discussions we had early on about how windows authentication could be supported in Kestrel, but that was by calling back into windows, not writing a fully managed implementation of ntlm, kerberos etc.

/cc @blowdart @DamianEdwards

[Eilon]

From @evil-shrike on January 25, 2018 15:33

We don't have any plans AFAIK to support windows authentication when running on linux.

This is a very pity, especially in contract with the support of Kerberos in Java... May I ask what are reasonings for such a decision?

[Eilon]

From @blowdart on January 25, 2018 15:35

Because it would be too risky and too hard to secure. We're not about to take a dependency on Samba.

[Eilon]

From @khellang on January 25, 2018 15:43

According to https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-active-directory-authentication, it looks like RHEL, SUSE and Ubuntu already have clients for Kerberos, though?

[Eilon]

From @Tratcher on January 25, 2018 17:28

It's not impossible, but it's an extremely large and high risk work item. We're still working on Kestrel's fundamentals such as protocol correctness, stability and performance. Large, high risk features will need to wait.

[Eilon]

From @evil-shrike on January 25, 2018 18:17

Well, ok, it's too early to expect Windows-auth in Kestrel, but we need some guidance on how to support Windows-auth on Linux in general in the meantime.

I can see two approaches:

• "reverse proxy" - all unauthenticated requests will be redirected to a Windows-IIS machine and then back - it can be achieved via some middleware I guess (on Linux side) and some simple app on Windows-side. But it would be nice to have some working and tested solution and not invent a wheel
• authenticate in web-server (hosting the aspnetcore app) - probably in Nginx/Apache modules - again it'd иу nice to have a list of good and working modules for every common server

So any recommendations (or any other piece of advice) are highly desirable.

[Eilon]

From @Tratcher on January 25, 2018 22:8

Your first scenario could be accomplished using OpenIdConnect and an auth server like IdentityServer4.

[Eilon]

@blowdart HI

[blowdart]

@evil-shrike when you say "Windows Authentication" what do you mean?

Do you want

1. "I want to use Windows Authentication to authenticate against a web site"
2. "I want to use Windows Authentication to authenticate against a web site and then I want to be able to impersonate that user so I can access network resources"
3. "I want to run my web site under a linux account that comes from a domain via kerberos and let it talk to SQL as that account"

Or something else altogether.

One thing to note up front - it's extremely unlikely we'd implement NTLM, that protocol needs to die and since Win2k it's Kerberos anyway.

[evil-shrike]

@blowdart I guess all these and other use-cases will find their use if we say "dotnetcore supports Windows auth on Linux". I mean people will want them. But in my particular case I need the 1st one - "I want to use Windows Authentication to authenticate against a web site".
It'd be even OK if I have just a ClaimsPrincipal in HttpContext.User (not WindowsPrincipal) for an authenticated (on server) user via Kerberos.

Also we need to be able to talk to LDAP/AD. It was overwhelming to know that currently we don't have API for LDAP/AD access on Linux (no System.DirectoryServices.Protocols).

I wouldn't care about NTLM if we'll have Kerberos. But correct me if I'm wrong that this means that authenticating via local Windows users won't work, right (as Kerberos requires a domain)?

[blowdart]

WRT NTLM: There's no local Windows users on a Linux system ... is that really a problem?

Directory Services is apparently coming, but that's .NET Core rather than ASP.NET Core.

The fun part of this is it might have to be part of .NET Core, because really WindowsPrincipal is very fixed to Windows, and that's what would do the delegation flow/impersonation. We'd have to examine the possibility of KerberosPrincipal of something of that ilk, but honestly the use cases need to come first to allow me to justify it and get the scope of the work figured out.

[evil-shrike]

WRT NTLM: There's no local Windows users on a Linux system ... is that really a problem?

yeah, sure, not a problem, sorry )

[blowdart]

Another question - is this for a stand alone box, or for containers?

I ask because joining your containers to a domain, or setting up SPNs for them seems wrong. In that case, if all you want is auth for a web site, using OIDC or WSFed to an ADFS server seems like the better option, this way it's clean with no dependencies. That way auth is taking care of by an auth provider, and your container has no pollution that demands connections to non-container infrastructure.

(Forgive me if I'm not using the right container terms here)

[evil-shrike]

I needed it for standalone server.
As for containers I understand your reasoning but I'm afraid that requiring a ADFS server imposes additional complexity for developing and testing. Also currently it's not very clear how to implement such an approach.