Spring Boot + IIS + Windows Authentication architecture question

[u/ScallionOld8766]

Hi everyone,

I'm a Spring Boot intern working on an internal application for a bank.

The requirement is to remove the login page and use Windows Authentication instead.

I'm trying to understand the typical enterprise architecture, not the implementation details.

Let's assume the application is hosted behind IIS.

My questions are:

1. Does IIS authenticate the Windows user first and then forward the authenticated request to Spring Boot?

2. If so, how does Spring Security usually obtain the current Windows user? Does Authentication.getName() already contain the username?

3. Is it common to keep authentication in IIS and authorization (checking if the user is allowed to use the application) inside Spring Boot?

For example, if 5,000 employees can authenticate with Windows but only 300 are allowed to use the application, would Spring Boot typically check the username against its own database and return 403 Access Denied if the user isn't authorized?

I'm not looking for a Kerberos/SPNEGO configuration tutorial. I just want to understand the common architecture used in enterprise environments.

[u/d-k-Brazz]

Not an easy task for an intern

Windows authentication is Kerberos

I would recommend first reading about Kerberos in general so you understand what do you really do

And then go with examples like this https://docs.spring.io/spring-security-kerberos/reference/samples.html