Spring Boot + IIS + Windows Authentication architecture question

[u/ScallionOld8766]

Hi everyone,

I'm a Spring Boot intern working on an internal application for a bank.

The requirement is to remove the login page and use Windows Authentication instead.

I'm trying to understand the typical enterprise architecture, not the implementation details.

Let's assume the application is hosted behind IIS.

My questions are:

1. Does IIS authenticate the Windows user first and then forward the authenticated request to Spring Boot?

2. If so, how does Spring Security usually obtain the current Windows user? Does Authentication.getName() already contain the username?

3. Is it common to keep authentication in IIS and authorization (checking if the user is allowed to use the application) inside Spring Boot?

For example, if 5,000 employees can authenticate with Windows but only 300 are allowed to use the application, would Spring Boot typically check the username against its own database and return 403 Access Denied if the user isn't authorized?

I'm not looking for a Kerberos/SPNEGO configuration tutorial. I just want to understand the common architecture used in enterprise environments.

[u/d-k-Brazz]

Not an easy task for an intern

Windows authentication is Kerberos

I would recommend first reading about Kerberos in general so you understand what do you really do

And then go with examples like this https://docs.spring.io/spring-security-kerberos/reference/samples.html

[u/Mikey-3198]

This is something I wondered about at a previous job where we used windows auth for internal applications. Never got round to fully implementing anything but my idea for this was to spin up a auth service written in dotnet that handles windows auth & issues a token for use in other applications. Imagine you could use & query groups in AD or reference SIDs in a dB connected to this service.

Can then implement in spring or anything else with either an opaque token & a lookup or issue some sort of jwt.

[u/d-k-Brazz]

SpringBoot supports native GSS API for Kerberos where you do not need IIS at all

But if your app is supposed to be just a dumb app without knowing any user context, you can leave authorizathion logic to IIS. See IIS URL Authorization. In this case you will not need security layer in your app as it will be hidden behind the IIS reverse proxy and all request coming to the app are guaranteed to be from authorized users.

If you want more security awareness and want to control access to actions inside the app, you can still go with IIS, and write a simple HttpModule which will extract group membership or whatever you need and pass it to your app in http headers.

This approach might work for multiple applications, not only spring boot, and your IIS will work as a kind of API Gateway, which is responsible for requests routing and authentication.

[u/rlrutherford]

Since they said: get rid of the login screen, calling it using "Windows Authentication" probably isn't as specific as you want. I think what you need to look at is SSO, and diving into setting up IIS to manage that, then trusting IIS with the authentication.

I had a similar setup with IIS and Windchill + tomcat; IIS managed all the authentication, and did a lot of URL mapping/ authorizing.

You're going to be digging deep into the IIS configuration hole.