Windows SSO
Windows Single-Sign On support for PowerShell Universal.
Last updated
Windows Single-Sign On support for PowerShell Universal.
Last updated
Windows Authentication, also know as Negotiate authentication, uses Kerberos or NTLM to authenticate without prompting the user for a password. It is primarily supported on Windows domains but can be configured in Linux and Mac OS.
Windows Authentication provides single-sign on support for browsers and environments that support it. To enable Windows Authentication, set the WindowsAuthentication enabled setting to true in appsettings.json.
You can enable Windows authentication by adding a new authentication provider in Security \ Authentication. Select Windows and enable the authentication.
Once Windows set to authenticated, Windows authentication can now be used against Universal. You will have to log out in order to use Windows authentication.
To enable Windows Authentication in IIS, ensure that you enable Windows Authentication and disable anonymous authentication.
In the web.config file that is included with PowerShell Universal, ensure that you have set the forwardWindowsAuthToken to true.
Windows Authentication is supported outside of IIS but requires configuration of the account running the Universal service.
On Windows, you should install PowerShell Universal as a Windows Service. Once the service is installed, you will need to create a service account user and set the service to run with that user's account. The Windows authentication setting needs to be set to true.
The service account needs to have a Service Principal Name (spn) configured for the computer account. You can do this using the setspn command. The computer name needs to be the full qualified name of the machine running Universal.
For more information, you can follow the Microsoft documentation for configuring ASP.NET Core Windows Authentication: Configuring a Windows machine for Windows Authentication
Configuring a Linux or Mac OS machine for Windows Authentication
PowerShell Universal will cache group membership claims when using Windows Authentication. Claims are cached for the configured session timeout value (default is 25 minutes).
To clear the cache manually, navigate to Security \ Roles and click the Clear Cached Claims button.
Depending on your local environment, you may need to configure your browser to properly pass credentials to PowerShell Universal.
