Recommended alternative to Windows Authentication

[swythan]

RE: "Windows Authentication (NTLM/Kerberos/Negotiate) can't be used with gRPC"

I've not been able to find any information on what the recommended alternative to using Windows Authentication is. I need something that:

• Can be used from a desktop app
• Is (largely) transparent to the user
• Provides per-user authentication & authorization
• Can be used when the entire domain is not attached to the internet. (Does this rule out Azure AD?)

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 363b40bb-4e20-e4b3-4456-5eb8fe6b30fb
• Version Independent ID: 8a7e85b0-5c1c-969d-9748-5e5e2dc45cce
• Content: Authentication and authorization in gRPC for ASP.NET Core
• Content Source: aspnetcore/grpc/authn-and-authz.md
• Product: aspnet-core
• Technology: aspnetcore-grpc
• GitHub Login: @JamesNK
• Microsoft Alias: jamesnk

[JamesNK]

@blowdart @HaoK Is there a simple answer to what to use instead of Windows Authentication? If there isn't a simple answer, is there another doc that could be linked to with more info?

[blowdart]

Not that I know of. The lack of internet connection rules out any options I can think of like adfs

[swythan]

The closest I came to finding an answer to this on my own was to build something on ADFS or (something like) Identity Server.

AFAICT ADFS should be usable in the scenario I was looking at, as it runs on the domain controller, right? It still didn't seem as easy to use as Windows authentication, though, and I couldn't tell whether it required upgrading all the domain controllers, or just separate servers running ADFS. We were having to bring in consultants to help us work out what to do.

I've actually left that organisation, so I can't give up to date details, but it was a Formula 1 team. The use case was that the trackside gear was carried to each race, and had to be able to operate without connection to the internet/WAN (although it usually was connected).

A possibly more intuitively understandable use case I heard mentioned (from the MS identity guys) is a large ship. It will have its own network, domain controller, etc, but it's physically impossible to guarantee an actual internet connection at any given time.