huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Avoid merging with anonymous users.

This commit is contained in:
Chris R 2016-01-20 16:29:20 -08:00
parent 488187ff79
commit c157d601a2
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Microsoft.AspNet.IISPlatformHandler/IISPlatformHandlerMiddleware.cs
View File

@ -105,7 +105,8 @@ namespace Microsoft.AspNet.IISPlatformHandler
if (_options.AutomaticAuthentication) if (_options.AutomaticAuthentication)
{ {
var existingPrincipal = httpContext.User; // Don't get it from httpContext.User, that always returns a non-null anonymous user by default.
var existingPrincipal = httpContext.Features.Get<IHttpAuthenticationFeature>()?.User;
if (existingPrincipal != null) if (existingPrincipal != null)
{ {
httpContext.User = SecurityHelper.MergeUserPrincipal(existingPrincipal, winPrincipal); httpContext.User = SecurityHelper.MergeUserPrincipal(existingPrincipal, winPrincipal);

3
test/TestSites/StartupNtlmAuthentication.cs
View File

@ -2,10 +2,12 @@
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
using System; using System;
using System.Security.Principal;
using Microsoft.AspNet.Builder; using Microsoft.AspNet.Builder;
using Microsoft.AspNet.Http; using Microsoft.AspNet.Http;
using Microsoft.AspNet.Http.Authentication; using Microsoft.AspNet.Http.Authentication;
using Microsoft.Extensions.Logging; using Microsoft.Extensions.Logging;
using Xunit;
namespace TestSites namespace TestSites
{ {
@ -47,6 +49,7 @@ namespace TestSites
{ {
if (context.User.Identity.IsAuthenticated) if (context.User.Identity.IsAuthenticated)
{ {
Assert.IsType<WindowsPrincipal>(context.User);
return context.Response.WriteAsync(context.User.Identity.AuthenticationType); return context.Response.WriteAsync(context.User.Identity.AuthenticationType);
} }
else else