You can configure a Turnkey application for Windows Integrated Authentication in an intranet, so IIS authenticates users with their existing Windows credentials before they reach Turnkey.

When to use this configuration

Use this configuration when your Turnkey site runs in an intranet and users should sign in through Windows Authentication, including Kerberos-based authentication handled by IIS.

This page covers Windows Integrated Authentication in IIS. For OpenID Connect, Azure AD, Microsoft, Facebook, and other external identity providers, see Documentation:External login services in MDriven Turnkey. For Azure AD through OpenID Connect specifically, see Documentation:Openid AzureAD.

Prerequisites

Before changing the application configuration:

• Ensure that the Turnkey site is hosted in IIS.
• Ensure that the users who access the site can be authenticated by the Windows environment used by IIS.
• Keep a copy of the current web.config and TurnkeySettings.xml before editing them.

Configure authentication in IIS

Configure IIS to authenticate the request before it is handled by Turnkey.

1. Open IIS Manager and select the Turnkey application.
2. Open Application Pools, select the application's pool, and set Managed Pipeline Mode to Integrated.
3. Select the Turnkey application and open Authentication.
4. Disable Anonymous Authentication.
5. Disable ASP.NET Impersonation.
6. Enable Windows Authentication.

IIS setting	Required value	Purpose
Managed Pipeline Mode	Integrated	Uses the IIS integrated request pipeline.
Anonymous Authentication	Disabled	Prevents unauthenticated anonymous requests from being accepted.
ASP.NET Impersonation	Disabled	Leaves Windows Authentication as the authentication mechanism configured for the site.
Windows Authentication	Enabled	Lets IIS authenticate the Windows user before the request reaches Turnkey.

Configure Turnkey

Turnkey normally starts its standard OWIN configuration. For Windows Authentication, disable that OWIN setup while retaining SignalR.

1. Open the Turnkey TurnkeySettings.xml file.
2. Add the following setting:

<TurnOffOWINButKeepSignalR>true</TurnOffOWINButKeepSignalR>

1. Open the Turnkey web.config file.
2. Remove the following line if it exists:

<authentication mode="None" />

1. In the system.web section, configure Windows authentication and deny anonymous users:

<system.web>
  <authentication mode="Windows" />
  <authorization>
    <deny users="?" />
  </authorization>
</system.web>

The ? user represents an anonymous user. Denying ? means that a request must be authenticated.

Do not use the old OWIN appSetting

Do not use the following older setting for this configuration:

<add key="owin:AutomaticAppStartup" value="false"/>

That setting disables the standard OWIN startup, but it also disables SignalR. Use TurnOffOWINButKeepSignalR in TurnkeySettings.xml instead.

Preserve the web.config change across redeployment

A Turnkey redeployment can replace application files. To make the modified configuration available from the Turnkey catalog after redeployment, add the modified Web.config.Something file to _AssetsTK.

For example, keep the version of the configuration that contains authentication mode="Windows" and the anonymous-user denial in _AssetsTK, then use that version when the application is redeployed.

Verify the result

1. Browse to the Turnkey site from a computer that is part of the intended Windows environment.
2. Confirm that IIS authenticates the user rather than allowing an anonymous request.
3. Confirm that the Turnkey application opens for the authenticated user.
4. If the site does not authenticate as expected, recheck the IIS Authentication feature first, then confirm that web.config contains mode="Windows" and that TurnkeySettings.xml contains TurnOffOWINButKeepSignalR.

Related authentication choices

Windows Authentication is one way to provide single sign-on. If your organization uses an external identity provider rather than IIS Windows Authentication, configure that provider separately. You can also control whether Turnkey displays local password login when external login is used; see Documentation:Hide Password login.

See also

• Documentation:External login services in MDriven Turnkey
• Documentation:Openid AzureAD
• Documentation:Hide Password login
• Documentation:Access control system in MDriven

External identity options

Windows Authentication is intended for IIS-hosted intranet scenarios: IIS authenticates the user before the request reaches Turnkey. The IIS and Turnkey configuration on this page applies to that pattern.

For Azure AD, Turnkey can be protected through Azure AD using OpenId. Register the Turnkey web application in Azure AD, copy the application ID and Azure AD authority name, and enter the values in the Turnkey portal or Turnkey settings configuration. The Azure AD OpenId authority has this form:

https://login.microsoftonline.com/<your authority>/

After saving the settings and selecting Send Settings And Restart, the application has an OpenId button that directs the user to the configured authority for verification. On a first login, Turnkey creates a SysUser object.

See Documentation:Openid AzureAD for the Azure AD registration and configuration steps.

MDriven also documents external login setup for Microsoft Authentication and Facebook Authentication in Documentation:External login services in MDriven Turnkey. Those instructions use the provider's application registration details and require saving the Turnkey portal settings and selecting Send settings and restart.

Scope of this page

This page covers Windows Authentication and its IIS and web.config configuration. Do not assume that the Windows Authentication settings are interchangeable with Azure AD OpenId or other external-login-provider settings.

Choose an SSO approach

Choose the authentication pattern that matches where your Turnkey application runs and where your users are authenticated. Single sign-on (SSO) means that the user is authenticated by the organization or external identity provider before or while they enter the application.

Deployment and identity scenario	Choose	What you configure	Example
Turnkey is hosted in IIS on an intranet, and users already authenticate with Windows or Kerberos.	Windows Authentication	Configure IIS Windows Authentication and the Turnkey web.config and TurnkeySettings.xml settings described on this page.	A user opens an internal Turnkey site from a domain-connected computer; IIS authenticates the Windows user before the request reaches Turnkey.
Turnkey uses an external identity provider that supports OpenID Connect.	OpenID Connect	Configure the provider values in Turnkey settings. Register the callback URL with the identity provider; OpenID Connect configuration describes the settings and redirect handling.	A Turnkey application uses an OpenID Connect provider and returns to https://YourTurnkeyURL/signin-oidc after authentication.
Your organization uses Azure AD for its directory.	Azure AD through OpenID Connect	Register the Turnkey web application in Azure AD, obtain the application ID and authority name, then save the values through the portal or in Turnkey settings. See Azure AD through OpenID Connect.	The authority is https://login.microsoftonline.com/<your authority>/; selecting the OpenId button sends the user to that authority for verification.
Users should sign in to Turnkey with an existing Google, Facebook, or Microsoft account.	External login service	Register the application with the selected provider, copy its client values to the MDriven portal, then select Send settings and restart.	A Google login registration uses a redirect URL ending in /signin-google.
Your organization requires SAML.	Confirm the supported configuration before implementation	This page does not document a SAML configuration for Turnkey.	Do not apply the IIS Windows Authentication or OpenID Connect settings as a substitute for a SAML configuration.

Configure the selected path

1. For an IIS intranet deployment, continue with Configure authentication in IIS and Configure Turnkey on this page.
2. For Azure AD, follow Azure AD through OpenID Connect. The first successful OpenID login creates a new SysUser object.
3. For another OpenID Connect identity provider, use OpenID Connect configuration. Store settings in App_Data/TurnkeySettings.xml, or use TurnkeySettingsOverride.xml when the settings must remain after the generated TurnkeySettings.xml is refreshed.
4. For Google, Facebook, or Microsoft account login, follow External login services in MDriven Turnkey.

Control the Turnkey login choices

When external login is the required sign-in route, you can hide the local password login with Hide Password login. For example, set HidePasswordLogin when users must use the configured external login instead of creating local accounts.

See also

• Documentation:OpenID config
• Documentation:Openid AzureAD
• Documentation:External login services in MDriven Turnkey
• Documentation:Hide Password login
• Documentation:TurnkeySettings