diff --git a/aspnetcore/blazor/security/blazor-web-app-with-entra.md b/aspnetcore/blazor/security/blazor-web-app-with-entra.md index 7dec9b1d4b1e..1e6b5bd4315f 100644 --- a/aspnetcore/blazor/security/blazor-web-app-with-entra.md +++ b/aspnetcore/blazor/security/blazor-web-app-with-entra.md @@ -1,7 +1,7 @@ --- title: Secure an ASP.NET Core Blazor Web App with Microsoft Entra ID author: guardrex -description: Learn how to secure a Blazor WebAssembly App with Microsoft Entra ID. +description: Learn how to secure a Blazor Web App with Microsoft Entra ID. monikerRange: '>= aspnetcore-9.0' ms.author: riande ms.custom: mvc diff --git a/aspnetcore/blazor/security/blazor-web-app-with-oidc.md b/aspnetcore/blazor/security/blazor-web-app-with-oidc.md index a3e4ef3b6bf4..eae9fe581cfb 100644 --- a/aspnetcore/blazor/security/blazor-web-app-with-oidc.md +++ b/aspnetcore/blazor/security/blazor-web-app-with-oidc.md @@ -1,7 +1,7 @@ --- title: Secure an ASP.NET Core Blazor Web App with OpenID Connect (OIDC) author: guardrex -description: Learn how to secure a Blazor WebAssembly App with OpenID Connect (OIDC). +description: Learn how to secure a Blazor Web App with OpenID Connect (OIDC). monikerRange: '>= aspnetcore-8.0' ms.author: riande ms.custom: mvc diff --git a/aspnetcore/blazor/security/blazor-web-app-with-windows-authentication.md b/aspnetcore/blazor/security/blazor-web-app-with-windows-authentication.md new file mode 100644 index 000000000000..01fd64130188 --- /dev/null +++ b/aspnetcore/blazor/security/blazor-web-app-with-windows-authentication.md @@ -0,0 +1,137 @@ +--- +title: Secure an ASP.NET Core Blazor Web App with Windows Authentication +author: guardrex +description: Learn how to secure a Blazor Web App with Windows Authentication. +monikerRange: '>= aspnetcore-9.0' +ms.author: riande +ms.custom: mvc +ms.date: 03/25/2025 +uid: blazor/security/blazor-web-app-windows-authentication +--- +# Secure an ASP.NET Core Blazor Web App with Windows Authentication + + + +This article describes how to secure a Blazor Web App with [Windows Authentication](/windows-server/security/windows-authentication/windows-authentication-overview) using a sample app. For more information, see . + +The app specification for the Blazor Web App: + +* Adopts the [Interactive Server render mode with global interactivity](xref:blazor/components/render-modes). +* Establishes an [authorization policy](xref:security/authorization/policies) for a [Windows security identifier](/windows-server/identity/ad-ds/manage/understand-security-identifiers) to access a secure page. + +## Sample app + +Access the sample through the latest version folder in the Blazor samples repository with the following link. The sample is in the `BlazorWebAppWinAuthServer` folder for .NET 9 or later. + +[View or download sample code](https://github.com/dotnet/blazor-samples) ([how to download](xref:blazor/fundamentals/index#sample-apps)) + +## Configuration + +The sample app doesn't require configuration to run locally. + +When deployed to a host, such as IIS, the app must adopt impersonation to run under the user's account. For more information, see . + +## Sample app code + +Inspect the `Program` file in the sample app for the following API calls. + + is called using the authentication scheme. configures the to use Negotiate (also known as Windows, Kerberos, or NTLM) authentication, and the authentication handler supports Kerberos on Windows and Linux servers: + +```csharp +builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme) + .AddNegotiate(); +``` + + adds authorization policy services. sets the fallback authorization policy, which is set to the default policy (). The default policy requires an authenticated user to access the app: + +```csharp +builder.Services.AddAuthorization(options => +{ + options.FallbackPolicy = options.DefaultPolicy; +}); +``` + + adds cascading authentication state to the service collection. This is equivalent to placing a `CascadingAuthenticationState` component at the root of the app's component hierarchy: + +```csharp +builder.Services.AddCascadingAuthenticationState(); +``` + +An [authorization policy](xref:security/authorization/policies) is added for a [Windows security identifier (SID)](/windows-server/identity/ad-ds/manage/understand-security-identifiers). The `S-1-5-113` well-known SID in the following example indicates that the user is a local account, which restricts network sign-in to local accounts instead of "administrator" or equivalent accounts: + +```csharp +builder.Services.AddAuthorizationBuilder() + .AddPolicy("LocalAccount", policy => + policy.RequireClaim( + "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + "S-1-5-113")); +``` + +The authorization policy is enforced by the `LocalAccountOnly` component. + +`Components/Pages/LocalAccountOnly.razor`: + +```razor +@page "/local-account-only" +@using Microsoft.AspNetCore.Authorization +@attribute [Authorize("LocalAccount")] + +

Local Account Only

+ +

+ You can only reach this page by satisfying the + LocalAccount authorization policy. +

+``` + +The `UserClaims` component lists the user's claims, which includes the user's Windows security identifiers (SIDs). + +`Components/Pages/UserClaims.razor`: + +```razor +@page "/user-claims" +@using System.Security.Claims +@using Microsoft.AspNetCore.Authorization +@attribute [Authorize] + +User Claims + +

User Claims

+ +@if (claims.Any()) +{ +
    + @foreach (var claim in claims) + { +
  • @claim.Type: @claim.Value
    • + } +
+} + +@code { + private IEnumerable claims = []; + + [CascadingParameter] + private Task? AuthState { get; set; } + + protected override async Task OnInitializedAsync() + { + if (AuthState == null) + { + return; + } + + var authState = await AuthState; + claims = authState.User.Claims; + } +} +``` + +## Additional resources + +* +* [Security identifiers (Windows Server documentation)](/windows-server/identity/ad-ds/manage/understand-security-identifiers) diff --git a/aspnetcore/toc.yml b/aspnetcore/toc.yml index ce4f7b10c395..603181cc0510 100644 --- a/aspnetcore/toc.yml +++ b/aspnetcore/toc.yml @@ -618,6 +618,8 @@ items: uid: blazor/security/blazor-web-app-entra - name: Blazor Web App with OIDC uid: blazor/security/blazor-web-app-oidc + - name: Blazor Web App with Windows Auth + uid: blazor/security/blazor-web-app-windows-authentication - name: Static server-side rendering threats uid: blazor/security/static-server-side-rendering - name: Interactive server-side rendering threats