8.11Configuring Kerberos and Active Directory Authentication

Kerberos is a network authentication protocol that uses symmetric-key cryptography to verify the identities of users and services. Through the ticket mechanism, Kerberos ensures that communication over the network is secure and can effectively prevent security threats such as eavesdropping and replay attacks. Since Windows 2000, Kerberos has become the default authentication protocol in domain environments.

Active Directory (AD) is a set of directory management services provided by Microsoft for the management and security configuration of Windows domain networks. It allows IT administrators to manage users, devices, and other resources in the network, and provides features such as authentication and authorization. AD supports multiple authentication protocols, including NTLM (NT LAN Manager), but Kerberos is more recommended because of its higher security.

If your application runs in a domain environment and the target service supports Windows authentication (such as Negotiate or NTLM), you can directly use the Windows authentication configuration approach. The following is a specific configuration example:

1. Using the current domain user's credentials (recommended)

This approach applies when the application and the target service run in the same domain environment. The system automatically authenticates using the current domain user's credentials.

12345678910111213

// Configure the default clientservices.AddHttpClient(string.Empty)    .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler    // Or use SocketsHttpHandler    {        UseDefaultCredentials = true    });// Configure a specific clientservices.AddHttpClient("furion")    .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler    // Or use SocketsHttpHandler    {        UseDefaultCredentials = true    });

2. Kerberos authentication across domains

If the application and the target service are not in the same domain environment, cross-domain authentication can be implemented by installing the Microsoft.Identity.Client library. This library provides support for Kerberos and other authentication protocols.

Installing the NuGet package

1

dotnet add package Microsoft.Identity.Client

Using Microsoft.Identity.Client to implement authentication

The following is a simple example showing how to use Microsoft.Identity.Client to obtain an access token and perform authentication:

123456789101112131415161718

using Microsoft.Identity.Client;// Configure authentication parametersvar clientId = "yourClientId";var tenantId = "yourTenantId";var authority = $"https://login.microsoftonline.com/{tenantId}";var app = PublicClientApplicationBuilder.Create(clientId)    .WithAuthority(authority)    .Build();// Obtain the access tokenvar scopes = new[] { "api://scopeOfTheTargetService" };var result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();// Use the access token to call the target servicehttpRemoteService.SendAsync(HttpRequestBuilder.Post("https://furion.net/")    .AddBearerAuthentication(result.AccessToken));

3. Reference documentation

• Microsoft.Identity.Client NuGet package
• Microsoft Authentication Library (MSAL) for .NET documentation
• How to authenticate with Kerberos using .NET

Through the configuration above, you can choose the appropriate authentication approach based on the environment in which your application runs, ensuring secure access to the target service.