Turn off / Disable windows authentication for asp.net-mvc

I created a new asp.net-mvc project and during setup I chose to use Windows Authentication.

Now I like to turn it off(at least for a while).

I changed the web.config to this

 <authentication mode="None" />

But that does change anything. It will still prompt me. I am using the IIS Express.

UPDATE: I mean it still prompts me when using Firefox. Internet Explorer will continue and not show my domain username

The web config should overwrite the IIS express config but in this case it seems it does not. What you can try to do is to turn it off on the IIS level as well.

You can go to this directory \IISExpress\config\applicationhost.config open up this file and set the <windowsAuthentication enabled="false" />.

I have an authorization attribute on a controller, but I'd like to turn it off on one action. I created my own authorization filter and added "Anonymous" into the Roles list. In my filter I then return true if Anonymous appears in the role list.

1.) Close VS

2.) Remove the .vs/config or the .vs folder next to your solution. The IIS Express regenerates the config/applicationhost.config file. Changing this file does NOT help - it is regenerated

3.) Edit the <project>.csproj.user file. There change the lines

<IISExpressAnonymousAuthentication>disabled</IISExpressAnonymousAuthentication>
<IISExpressWindowsAuthentication>enabled</IISExpressWindowsAuthentication>

to

<IISExpressAnonymousAuthentication>enabled</IISExpressAnonymousAuthentication>
<IISExpressWindowsAuthentication>disabled</IISExpressWindowsAuthentication>

4.) Edit and change the web.config Change

<authentication mode="Windows" />

to

<authentication mode="None" />

or comment the whole authentication XML element.

The project's properties enable Windows Authentication and disable Anonymous Authentication: Right-click the project in Solution Explorer and select Properties. Select the Debug tab. Clear the check box for Enable Anonymous Authentication.

I found this was possible in the web config by using the following documentation:

https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-3.1&tabs=visual-studio

The relevant bloc of web.config is:

  <security>
    <authentication>
      <windowsAuthentication enabled="false" />
    </authentication>
  </security>

I created a new asp.net-mvc project and during setup I chose to use Windows Authentication. Now I like to turn it off(at least for a while). I changed the web.config to this <authentication mode="None" /> But that does change anything. It will still prompt me. I am using the IIS Express. UPDATE: I mean it still prompts me when using Firefox.

Network Level Authentication (NLA) This blog post is divided into two sections: the first section relates to the machines Without RD Session Host Role, while the second part refers to the machines With RD Session Host Role.

Normally admin follows the steps below to disable ulti-factor authentication: 1. Go to the Office 365 admin center. 2. Go to Users > Active users. 3. Choose More > Setup Azure multi-factor auth. 4. Check your account. 5. Click Disable on the right. For more information, please refer to Set up multi-factor authentication for Office 365 users.

Although Microsoft introduced a more secure Kerberos authentication protocol in Windows 2000, the NTLM (generally, it is NTLMv2) is still widely used for authentication on Windows domain networks. In this article, we’ll consider how to disable NTLMv1 and NTLMv2 protocols and start using Kerberos in your Active Directory domain.

Comments
  • I found a file named administration.config in that folder where I added your suggested line. But Firefox still prompts for credentials
  • It is not the administration.config. It should be applicationhost.config. Can you search for this file under your IISExpress directory and edit is as admin then restart IIS.
  • Just to clarify, IE does not prompt you to login. Is that correct?
  • Well IE is using impersonate I suspect and it also works for IE. When I turn it on it will display my username and when i turn it off it wont show my username. So yes I believe the problem is only for Firefox
  • Might be a long shot but have you tried with Chrome? It is possible that it could be Firefox caching. Does that happen with inprivate/incognito sessions as well?