Revert "Enable Windows Authentication in web.config"

This reverts commit 81c6604295.

Common/NtlmHelper.cs

@@ -0,0 +1,33 @@
+using Microsoft.Win32.SafeHandles;
+using System.Runtime.InteropServices;
+
+namespace FakeNTLMServer.Common
+{
+    public static class NtlmHelper
+    {
+        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+        private static extern bool LogonUser(
+            string lpszUsername,
+            string lpszDomain,
+            string lpszPassword,
+            int dwLogonType,
+            int dwLogonProvider,
+            out SafeAccessTokenHandle phToken);
+
+        private const int LOGON32_LOGON_NETWORK = 3;
+        private const int LOGON32_PROVIDER_DEFAULT = 0;
+
+        public static bool ValidateCredentials(string username, string domain, string password, out SafeAccessTokenHandle token)
+        {
+            var success = LogonUser(
+                username,
+                domain,
+                password,
+                LOGON32_LOGON_NETWORK,
+                LOGON32_PROVIDER_DEFAULT,
+                out token);
+
+            return success && token is not null && !token.IsInvalid;
+        }
+    }
+}

Controllers/AuthController.cs

@@ -1,24 +1,108 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using System.Security.Principal;
+using FakeNTLMServer.Model;
+using FakeNTLMServer.Common;
 
-namespace FakeNTLMServer.Controllers
+namespace FakeNTLMServer.Controllers;
+
+[ApiController]
+[Route("[controller]")]
+public class AuthController : ControllerBase
 {
-    [ApiController]
-    [Route("[controller]")]
     [Authorize]
-    public class AuthController : ControllerBase
+    [HttpGet(nameof(Me))]
+    public IActionResult Me()
     {
-        [HttpGet("me")]
-        public IActionResult GetMe()
+        var identity = User.Identity;
+        return Ok(new
         {
-            var identity = User.Identity;
+            identity?.Name,
+            identity?.AuthenticationType,
+            identity?.IsAuthenticated,
+            Claims = User.Claims.Select(claim => new { claim.Type, claim.Value })
+        });
+    }
+
+    /// <summary>
+    /// NTLM/Negotiate login endpoint.
+    /// Triggers the NTLM handshake and returns authenticated user info.
+    /// </summary>
+    [Authorize]
+    [HttpGet(nameof(Login))]
+    public IActionResult Login()
+    {
+        var identity = User.Identity;
+
+        if (identity is null || !identity.IsAuthenticated)
+            return Unauthorized(new { Message = "NTLM authentication failed." });
+
+        return Ok(new
+        {
+            Message = "NTLM authentication successful.",
+            identity.Name,
+            identity.AuthenticationType,
+            identity.IsAuthenticated,
+            Claims = User.Claims.Select(claim => new { claim.Type, claim.Value })
+        });
+    }
+
+    /// <summary>
+    /// Validates Windows credentials (username/password) using the Win32 LogonUser API.
+    /// Works on local Kestrel without IIS or Negotiate middleware.
+    /// </summary>
+    [AllowAnonymous]
+    [HttpPost("login")]
+    public IActionResult LoginWithCredentials([FromBody] Login request)
+    {
+        var username = request.Username;
+        var domain = request.Domain ?? ".";
+
+        if (username.Contains('\\'))
+        {
+            var parts = username.Split('\\', 2);
+            domain = parts[0];
+            username = parts[1];
+        }
+        else if (username.Contains('@'))
+        {
+            var parts = username.Split('@', 2);
+            username = parts[0];
+            domain = parts[1];
+        }
+
+        if (!NtlmHelper.ValidateCredentials(username, domain, request.Password, out var token))
+        {
+            return Unauthorized(new { Message = "Invalid username or password." });
+        }
+
+        using (token)
+        {
+            var windowsIdentity = new WindowsIdentity(token.DangerousGetHandle());
+            var claims = windowsIdentity.Claims.Select(c => new { c.Type, c.Value }).ToList();
+
             return Ok(new
             {
-                identity?.Name,
-                identity?.AuthenticationType,
-                identity?.IsAuthenticated,
-                Claims = User.Claims.Select(claim => new { claim.Type, claim.Value })
+                Message = "Authentication successful.",
+                Name = windowsIdentity.Name,
+                AuthenticationType = windowsIdentity.AuthenticationType,
+                IsAuthenticated = windowsIdentity.IsAuthenticated,
+                Claims = claims
             });
         }
     }
+
+    [Authorize]
+    [HttpGet(nameof(Status))]
+    public IActionResult Status()
+    {
+        return Ok(new
+        {
+            User.Identity?.Name,
+            User.Identity?.AuthenticationType
+        });
+    }
+
+    [HttpGet(nameof(Test))]
+    public IActionResult Test() => Ok();
 }

FakeNTLMServer.csproj

@@ -1,9 +1,13 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
+	<Version>1.0.0-beta</Version>
+	<AssemblyVersion>1.0.0.0</AssemblyVersion>
+	<FileVersion>1.0.0.0</FileVersion>
+	<InformationalVersion>1.0.0-beta</InformationalVersion>
   </PropertyGroup>
 
   <ItemGroup>

Model/Login.cs

@@ -0,0 +1,23 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace FakeNTLMServer.Model;
+
+public class Login
+{
+    /// <summary>
+    /// Username. Supports formats: "username", "DOMAIN\username", "username@domain"
+    /// </summary>
+    [Required]
+    public string Username { get; set; } = default!;
+
+    /// <summary>
+    /// Password
+    /// </summary>
+    [Required]
+    public string Password { get; set; } = default!;
+
+    /// <summary>
+    /// Domain (optional). Defaults to local machine ("."). Ignored if domain is included in Username.
+    /// </summary>
+    public string? Domain { get; set; }
+}

Program.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Authentication.Negotiate;
+using Microsoft.OpenApi.Models;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -6,20 +7,59 @@ var builder = WebApplication.CreateBuilder(args);
 // Add services to the container.
 
 builder.Services.AddControllers();
-builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
-    .AddNegotiate();
+    builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
+        .AddNegotiate();
 builder.Services.AddAuthorization();
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddEndpointsApiExplorer();
-builder.Services.AddSwaggerGen();
+builder.Services.AddSwaggerGen(options =>
+{
+    options.SwaggerDoc("v1", new OpenApiInfo
+    {
+        Title = "FakeNTLMServer",
+        Version = "v1",
+        Description = "NTLM/Negotiate authentication test server"
+    });
+
+    options.AddSecurityDefinition("Negotiate", new OpenApiSecurityScheme
+    {
+        Type = SecuritySchemeType.Http,
+        Scheme = "Negotiate",
+        Description = "Windows Authentication (NTLM/Kerberos). Credentials are sent automatically by the browser."
+    });
+
+    options.AddSecurityRequirement(new OpenApiSecurityRequirement
+    {
+        {
+            new OpenApiSecurityScheme
+            {
+                Reference = new OpenApiReference
+                {
+                    Type = ReferenceType.SecurityScheme,
+                    Id = "Negotiate"
+                }
+            },
+            Array.Empty<string>()
+        }
+    });
+
+    var xmlFile = $"{System.Reflection.Assembly.GetExecutingAssembly().GetName().Name}.xml";
+    var xmlPath = Path.Combine(AppContext.BaseDirectory, xmlFile);
+    if (File.Exists(xmlPath))
+        options.IncludeXmlComments(xmlPath);
+});
 
 var app = builder.Build();
 
 // Configure the HTTP request pipeline.
-if (app.Environment.IsDevelopment())
+if (app.Environment.IsDevelopment() || app.Configuration.GetValue<bool>("EnableSwagger"))
 {
     app.UseSwagger();
-    app.UseSwaggerUI();
+    app.UseSwaggerUI(options =>
+    {
+        // Enable sending credentials (NTLM tokens) with Swagger UI requests
+        options.ConfigObject.AdditionalItems["withCredentials"] = true;
+    });
 }
 
 app.UseHttpsRedirection();

appsettings.json

@@ -5,5 +5,11 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "Kestrel": {
+    "EndpointDefaults": {
+      "Protocols": "Http1"
+    }
+  },
+  "EnableSwagger": true
 }

web.config

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <system.webServer>
+    <handlers>
+      <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
+    </handlers>
+    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" hostingModel="InProcess">
+      <environmentVariables>
+        <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" />
+      </environmentVariables>
+    </aspNetCore>
+  </system.webServer>
+</configuration>