You can configure an IIS-hosted MDrivenServer to identify users through Windows Authentication instead of the default forms username and password; this guide is for administrators of MDrivenServer, including installations used with MDriven Turnkey.

Before you begin

This procedure applies to MDrivenServer hosted in IIS on Windows. Install and verify MDrivenServer before changing its authentication settings; see HowTos:Installing MDriven Server on Windows.

MDrivenServer has two authentication surfaces that must be configured together:

Surface	What it covers	Configuration file
Web UI	Pages opened in a browser, including administration pages.	App_Data/WebServices_SecurityWEBUIActual.config
WCF services	Service endpoints used by clients and by the MDrivenServer web application.	App_Data/WebServices_SecurityWCFActual.config

Windows Authentication establishes who the caller is, for example CONTOSO\\alice. MDrivenServer authorization then determines what that identified account may do through its assigned role.

Enable Windows Authentication in IIS

1. Open IIS Manager.
2. Select the MDrivenServer application.
3. Open Authentication.
4. Enable Windows Authentication.

If Windows Authentication is not listed, add the Windows Authentication IIS role service on the server, then return to IIS Manager and enable it for the MDrivenServer application. The Windows installation guide lists Windows Authentication among the IIS authentication features that you can add: HowTos:Installing MDriven Server on Windows.

Switch MDrivenServer to Windows Authentication

1. Start MDrivenServer.
2. In a browser, open <your-site>/AccessFromServer.aspx.
3. Select Use Windows Auth.
4. Confirm that the page identifies you with your Windows domain account. For example, an account in the CONTOSO domain is displayed as CONTOSO\\alice.

The button changes the MDrivenServer configuration used for both the web UI and WCF services. Do not configure only one of these surfaces: the web application also needs to call the WCF services.

Understand the configuration files

MDrivenServer's web.config uses the configSource attribute to load configuration sections from files in the App_Data directory. The files whose names contain Actual are the active configuration files.

Active file	Purpose	Alternatives copied into the active file
WebServices_ActualWFC.config	Configures WCF endpoints for SSL or HTTP-only operation.	Webservices_NoSSL.config or Webservices_WithSSL.config
WebServices_SecurityWCFActual.config	Configures WCF bindings and their authentication mode.	WebServices_SecurityWCFForms.config or WebServices_SecurityWCFWindows.config
WebServices_SecurityWEBUIActual.config	Configures the web UI authentication mode.	WebServices_SecurityWEBUIForms.config or WebServices_SecurityWEBUIWindows.config

The controls on AccessFromServer.aspx select these alternatives:

• Use Windows Auth copies the Windows Authentication variants into WebServices_SecurityWCFActual.config and WebServices_SecurityWEBUIActual.config.
• Use Forms Auth restores the forms-authentication variants for those two active files.
• Use SSL setting copies the SSL endpoint configuration into WebServices_ActualWFC.config.
• Use HttpOnly Setting copies the non-SSL endpoint configuration into WebServices_ActualWFC.config.

For an HTTPS IIS installation, configure the certificate and binding as described in HowTos:Installing MDriven Server on Windows. Use the certificate URL when accessing the server; the installation guidance warns that internal server communication cannot ignore a certificate error.

Authorize Windows accounts in MDrivenServer

Authentication does not grant access by itself. After MDrivenServer receives a Windows identity, add that identity to MDrivenServer and assign the appropriate role.

1. Open <your-site>/admin/UsersAndRolesAdmin.aspx.
2. Add each Windows account that needs access.
3. Assign roles according to the access the account needs.

Role or setting	Use it for	Important consequence
SuperAdmin	The IIS application-pool identity and developers who must control the executed model.	The application-pool identity needs this role because the MDrivenServer web application calls its own WCF services.
AppUser	Other users who need normal application access.	Use this instead of SuperAdmin when the user does not need to control the executed model.
Admin Require Identification	Restricting administrative changes to identified accounts.	Without this setting, any authenticated user can make changes.
Services require identification	Restricting WCF service access to authorized accounts.	When enabled, add the IIS application-pool account or MDrivenServer cannot use the WCF services it requires.

For example, if the MDrivenServer application pool runs as CONTOSO\\MDrivenServerPool, add CONTOSO\\MDrivenServerPool and give it the SuperAdmin role. Add CONTOSO\\alice as SuperAdmin only if Alice must control the executed model; otherwise assign AppUser.

Verify the configuration

1. Open <your-site>/AccessFromServer.aspx and confirm that your Windows domain identity is shown.
2. Open an MDrivenServer web UI page and confirm that IIS does not prompt for the former MDrivenServer forms credentials.
3. With Services require identification enabled, verify that the application continues to operate. A failure at this point commonly means that the application-pool identity has not been added and authorized.
4. Sign in as an account with the AppUser role and confirm it has application access but not SuperAdmin-level control.

Security and operational notes

• Configure Windows Authentication for both the web UI and WCF services by using the control on AccessFromServer.aspx; changing IIS settings alone does not select the MDrivenServer Windows-authentication configurations.
• Enable Admin Require Identification and Services require identification only after you have added and authorized the application-pool identity. Otherwise, MDrivenServer can lose access to its own services.
• If you need general configuration, maintenance, or recovery guidance, see HowTos:Configure and Maintain MDriven Server.
• This page concerns Windows Authentication on IIS. For other sign-on scenarios, see Documentation:SingleSignOn.

See also

• HowTos:Installing MDriven Server on Windows
• HowTos:Configure and Maintain MDriven Server
• Documentation:SingleSignOn
• HowTos:Install MDriven Server and Turnkey on Microsoft Azure