Hi,

The HTML to PDF converter will try to use the calling thread's security context. This is not necessarily the same as the app pool identity. For example, if IIS impersonation is enabled, then it will switch to the client user's security context to run the request in that context. The general idea is to use an account with as less privilege as possible. This also means the privilege the HTML to PDF converter receives is usually less than the privilege of the app pool account.

As a simple test, you can use WindowsIdentity.GetCurrent to check the current user context. That should help you identify the root of the problem.

Thanks!

We use your current calling code's security context. This is not necessarily the client's security context. I mention the client's security context in my previous post is just to give you an example about how your code could run in a different security context than the app's pool's security context.

So basically if have two line of code like this:



Then us (the second line) will receive exactly the same permission/privilege as the first line DoSomethingElse(). This is how it supposes to work. In another word, we take whatever you give us as is. Exactly how you get to this point, how many hops you have made before you reach us is controlled by you, not by us. Because of this and also because security is a generic Windows topic, we do not provide support on it. So you may want to search online on how to call specific code with app pool identity. It is neither our responsibility nor our expertise to cover such topics since the issue is generic in nature and it does not have anything particular to do with our product.

Hi,

You have to find out how your web server handles the authentication and exactly what it needs to establish the credentials. Once you find out exactly what it needs, you can then look into our product to find out whether there is a way to pass that information to your web server through our product or not ---- we may have a way for you to pass through or may not. Once you are clear about the first part (how your web server handles authentication and what it needs), we can help you with the second part (whether there is a way to provide such information through our product).

Thanks!

Hi,

This makes sense. OAuth is a protocol on top of the HTTP protocol so whatever authentication result you have between the client and your website is exchanged between your client and your website. It does not propagate further automatically. The following flow is a very simplified version of what's going on:

1. Your client logs in and get an access token. Say access_token=123456;
2. Your client access a protected resource using this token. Say http://yourserver/protected_resource?access_token=123456;
3. Your server checks this access token and proceed after verifying this token;
4. Your server side code also calls HtmlToPdf.ConvertUrl("http://yourserver/protected_resource2") to convert another protected page;
5. Note that the access token does not exist in the Url you passed to ConvertUrl. As a result once this request reaches your web server again, it will be treated as anonymous;

So the key is for you to pass whatever information you have in step 2 to EO.Pdf in step 4, and this does not happen automatically. In reality it's much more complicated than just passing a single access token. And you may also need to use HTTP POST instead of HTTP GET (ConvertUrl uses HTTP GET). You can take a look of this Microsoft document about exactly how oAuth works and how you can satisify your web server:

https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

Hope this helps.

Thanks!

SOLUTION

Hi, I now have a working solution. I have accepted that EO.Pdf will request the CSS etc as ANONYMOUS and have therefore configured the Mvc Core web site to work with both Anonymous and Windows Authentication schemes.

This requires both IIS to be set to allow both Anonymous and Windows Authentication for the website.

The website needs a code change as follows:-

Note: Requires Nuget package Microsoft.AspNetCore.Authentication

Startup.cs


// set the default authentication scheme when IIS allows anonymous and windows authentication
services.AddAuthentication(IISDefaults.AuthenticationScheme);


Web.config
<add accessType="Allow" users="?" />


I now get anonymous requests to the website but they get 200 responses now.


i hope this is helpful to someone else.