title: MVC5 vs Windows Authentication in IIS 7.5: unable to login
body: <p>I'm trying to secure Asp.Net MVC5 application to use Windows authentication.</p>
  
  <p>I have mostly followed this article: <a href="http://msdn.microsoft.com/en-us/library/gg703322%28v=vs.98%29.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/gg703322%28v=vs.98%29.aspx</a></p>
  
  <p>And when I go to pages, I'm presented with login/username textboxes: 
  <img src="https://i.stack.imgur.com/3qmAv.png" alt="enter image description here"></p>
  
  <p>I type correct username/password and I'm asked for the same details again. And again and again. I've tried to do add machine name before the login ( local machine does not have a domain), but no luck.</p>
  
  <p>In web.config I have: </p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;
  </code></pre>
  
  <p>In IIS 7.5 I have the following for the authentication: </p>
  
  <p><img src="https://i.stack.imgur.com/cx9gE.png" alt="enter image description here"></p>
  
  <p>Controller action I request looks like this: </p>
  
  <pre><code>public partial class HomeController : BaseController
  {
      private readonly IMediator mediator;
  
      public HomeController(IMediator mediator)
      {
          this.mediator = mediator;
      }
  
      public virtual ActionResult Index()
      {
          var model = mediator.Request(new MenuModelQuery());
          return View(model);
      }
  </code></pre>
  
  <p>If I turn off any authentication (enable anonymous) - everything works fine. I have tried playing with different user for Application Pool for the web-site - no change. I have added <code>[AllowAnonymous]</code> attribute to the controller action - no change. I have tried [Authorize(User="trailmax")] - no change in the behaviour. </p>
  
  <p>Fiddler shows that authenticate header is passed every time when I put username/password in:</p>
  
  <p>Request:</p>
  
  <pre><code>GET http://reporting.dev/ HTTP/1.1
  Host: reporting.dev
  Connection: keep-alive
  Cache-Control: max-age=0
  Authorization: Negotiate TlRMTVNTUAABblahblahblahblah=
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  </code></pre>
  
  <p>Response: </p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Content-Type: text/html; charset=us-ascii
  Server: Microsoft-HTTPAPI/2.0
  WWW-Authenticate: Negotiate TlRMTVNTUAACAAA_some_long_stringkLP9zgEAAAAA
  Date: Fri, 20 Dec 2013 18:44:50 GMT
  Content-Length: 341
  Proxy-Support: Session-Based-Authentication
  </code></pre>
  
  <p>I'm out of ideas. Can you suggest anything?</p>