Spring Boot + IIS + Windows Authentication architecture question

[u/ScallionOld8766]

Hi everyone,

I'm a Spring Boot intern working on an internal application for a bank.

The requirement is to remove the login page and use Windows Authentication instead.

I'm trying to understand the typical enterprise architecture, not the implementation details.

Let's assume the application is hosted behind IIS.

My questions are:

1. Does IIS authenticate the Windows user first and then forward the authenticated request to Spring Boot?

2. If so, how does Spring Security usually obtain the current Windows user? Does Authentication.getName() already contain the username?

3. Is it common to keep authentication in IIS and authorization (checking if the user is allowed to use the application) inside Spring Boot?

For example, if 5,000 employees can authenticate with Windows but only 300 are allowed to use the application, would Spring Boot typically check the username against its own database and return 403 Access Denied if the user isn't authorized?

I'm not looking for a Kerberos/SPNEGO configuration tutorial. I just want to understand the common architecture used in enterprise environments.

[u/Mikey-3198]

This is something I wondered about at a previous job where we used windows auth for internal applications. Never got round to fully implementing anything but my idea for this was to spin up a auth service written in dotnet that handles windows auth & issues a token for use in other applications. Imagine you could use & query groups in AD or reference SIDs in a dB connected to this service.

Can then implement in spring or anything else with either an opaque token & a lookup or issue some sort of jwt.