I tries to call an IIS hosted Net CORE REST API from my (first) angular project. I hosted the angular on my local IIS and successfully set up (the angular web) to accept Windows Authenticated user only. When I load the angular web index.html the browser asks my credentials.
Inside my angular component I tried to execute a http delete operation (to delete an item from something), which (on the other side) checks if the caller has permission, so tries to get the caller AD identity.
I tried the followings:
constructor(private http: HttpClient) {}
onClick() {
< some preparation here, construct parms as HttpParams(), etc ... >
this.http.delete<ApiHttpRawResponse>(finalUrl,
{ headers: new HttpHeaders({ 'Content-Type': 'application/json' }),
responseType: 'json',
params: parms,
withCredentials: true
} )
}
It returns with 'has no idea how you are' error. After several hours I tried to call it using fetch:
fetch(finalUrl, {
method: 'DELETE',
credentials: 'include',
headers: {
'Content-Type': 'application/json',
'Authorization': 'Negotiate'
}
})
Both fails. Debugging on the Net CORE REST API side I see that the Http Context knows nothing about the caller:
public WebLocatingService(IHttpContextAccessor httpContextAccessor)
{
var ctx = httpContextAccessor.HttpContext;
var identityName = ctx?.User?.Identity?.Name;
< here I see identityName is null :( >
The angular project on IIS has the following web.config:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>
Since I do everything suggested on different angular blogs, document sites, etc ... still don't know where to find my mistake. I added the fetch call to check if my poor angular knowledge is the reason - but fetch also won't work. But from a console net core tool I can call the rest api with success, so I clearly has no idea what to do next.
Please, anyone has any idea how to solve the authentication problem?
---- ADDITIONAL INFO ---- (at the end) ---
- enabling Anonymus on IIS seems resolving the CORS preflight problem, but wont force the JS side to send the auth data
- disabling anonymus on IIS side + install CORS module is the way to solve the problems (not on IIS Express but on IIS)
- HttpClient works well (with withCredentials: true ) - no doubt, even when the angular project is hosted by "ng server"
- for some reasons fetch is a though guy in this case
