WindowsIdentity.AuthenticationType throws under IIS but not IIS Express

[brockallen]

When performing windows authentication I am accessing User.Identity.AuthenticationType to know if "Negotiate" or "NTLM" was used for authentication. On IIS Express this works, but when published to IIS I get this exception:

2017-01-06 12:20:55.109 -05:00 [Error] An unhandled exception has occurred while executing the request
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
   at System.Security.Principal.WindowsIdentity.get_AuthenticationType()
   at IdentityServer4.Quickstart.UI.AccountController.<ExternalLogin>d__9.MoveNext() in C:\ballen\github\identity\IdSvr4\IdentityServer4\src\Host\Quickstart\Account\AccountController.cs:line 179

And I see the code is throwing here: https://referencesource.microsoft.com/#mscorlib/system/security/principal/windowsidentity.cs,315

So I am guessing that IIS Express, running as me as admin, is allowed to make the Win32 call, whereas IIS' app pool identity is not.

I think this permissions idea is sort of a red herring, though, as I'd expect the m_AuthType to be initialized when the windows identity is created. This SO article seems to corroborate it: https://stackoverflow.com/questions/11587305/unauthorizedaccessexception-after-using-logonuser/11588736#11588736

So I'm not sure where the WindowsIdentity is created, but it seems to make sense to pass in the auth type to the ctor, rather then defer to a Win32 call.

Originally opened here: IdentityServer/IdentityServer4#650 (comment)

[Tratcher]

See aspnet/IISIntegration#231

[brockallen]

Ok, closing as a dup. Thanks.

[springy76]

I'm on aspnetcore 2.1 and just inserted @this.User.Identity.AuthenticationType to a razor page. Shows 'NTLM' or 'Kerberos" on my local IISExpress machine (different browsers) and kaboom explodes on real IIS due to this UnauthorizedAccessException.

2018 is done soon, these tickets are more than 2 years old and all closed/solved in a way I don't know if just some workarounds have been applied here and there or this problem got reintroduced.

[Tratcher]

ASP.NET Core worked around the issue like this: https://github.com/aspnet/IISIntegration/pull/282/files

If you want a fix for WindowsIdentity you'll need to ask https://github.com/dotnet/corefx.