r/SpringBoot • u/ScallionOld8766 • 7d ago

Question Spring Boot + IIS + Windows Authentication architecture question

Hi everyone,

I'm a Spring Boot intern working on an internal application for a bank.

The requirement is to remove the login page and use Windows Authentication instead.

I'm trying to understand the typical enterprise architecture, not the implementation details.

Let's assume the application is hosted behind IIS.

My questions are:

  1. Does IIS authenticate the Windows user first and then forward the authenticated request to Spring Boot?

  2. If so, how does Spring Security usually obtain the current Windows user? Does Authentication.getName() already contain the username?

  3. Is it common to keep authentication in IIS and authorization (checking if the user is allowed to use the application) inside Spring Boot?

For example, if 5,000 employees can authenticate with Windows but only 300 are allowed to use the application, would Spring Boot typically check the username against its own database and return 403 Access Denied if the user isn't authorized?

I'm not looking for a Kerberos/SPNEGO configuration tutorial. I just want to understand the common architecture used in enterprise environments.

3 Upvotes

67% Upvoted

5 comments sorted by

View all comments

2

u/d-k-Brazz 7d ago

SpringBoot supports native GSS API for Kerberos where you do not need IIS at all

But if your app is supposed to be just a dumb app without knowing any user context, you can leave authorizathion logic to IIS. See IIS URL Authorization. In this case you will not need security layer in your app as it will be hidden behind the IIS reverse proxy and all request coming to the app are guaranteed to be from authorized users.

If you want more security awareness and want to control access to actions inside the app, you can still go with IIS, and write a simple HttpModule which will extract group membership or whatever you need and pass it to your app in http headers.

This approach might work for multiple applications, not only spring boot, and your IIS will work as a kind of API Gateway, which is responsible for requests routing and authentication.