Seeking Help with Windows Authentication Issue in PowerShell Universal
Environment Configuration
Server Details:
• Operating System: Windows Server 2019
• PowerShell Universal Version: Latest
• Database: SQL Server
Key Components:
• PowerShell Universal (PSU) installed and configured.
• HTTPS enabled using a certificate.
• Windows Authentication enabled.
• DNS A Record: powershelluniversal.example.com pointing to the IP address of the PSU server.
Configuration Details
appsettings.json:
{
“Kestrel”: {
“Endpoints”: {
“HTTPS”: {
“Url”: “https://*:443”,
“Certificate”: {
“Path”: “D:\Path\To\Cert\cert-powershelluniversal.example.com.pfx”,
“Password”: “YourPfxPassword”
}
}
},
“RedirectToHttps”: true
},
“Plugins”: [
“SQL”
],
“Data”: {
“RepositoryPath”: “D:\Path\To\Repository”,
“ConnectionString”: “Server=YourSQLServer;Database=PSU;Integrated Security=true;TrustServerCertificate=True”
},
“Authentication”: {
“Windows”: {
“Enabled”: true
}
}
}
SPN Registration:
setspn -S HTTP/powershelluniversal.example.com DOMAIN\ServiceAccount
Claims-Based Mapping:
• Configured a claims-based map against a GroupSID for the Admins role.
Issue Description
Despite following the above configuration steps, I am encountering issues with Windows Authentication. Specifically, when accessing the PowerShell Universal web interface, a credential prompt appears, and users are not logged in automatically using their Windows credentials.
Observed Behavior:
• Users are prompted for credentials instead of being authenticated automatically.
• After entering credentials, access is sometimes denied with a 403 error.
Troubleshooting Steps Taken
1. Verified SPN Registration:
• Confirmed using setspn -Q HTTP/powershelluniversal.example.com.
2. Checked Kerberos Tickets:
• Cleared existing tickets using klist purge.
• Verified new tickets using klist.
3. Browser Configuration:
• Ensured browsers are configured to pass Windows credentials automatically.
4. Configuration Verification:
• Ensured appsettings.json is correctly configured.
• Verified HTTPS setup and SPN registration.
5. Service Account Permissions:
• Granted the service account “Allowed to authenticate” permissions in Active Directory.
• Enabled Kerberos delegation in security settings.
Request for Assistance
I am seeking assistance from the Ironman Software community to resolve the Windows Authentication issue. Specifically, I am looking for guidance on:
1. Additional Configuration Steps: Any missed configuration settings or best practices for setting up Windows Authentication with PSU.
2. Debugging Tips: Effective methods to debug and trace authentication issues.
3. Community Experiences: Insights or similar experiences from other users who have successfully implemented Windows Authentication in PSU.
Your expertise and suggestions would be greatly appreciated.
Thank you!
Product: PowerShell Universal
Version: 4.3