{"id":11454,"date":"2025-01-12T14:00:44","date_gmt":"2025-01-12T05:00:44","guid":{"rendered":"https:\/\/chat-messenger.com\/?p=11454"},"modified":"2026-08-04T01:04:02","modified_gmt":"2026-08-03T16:04:02","slug":"iis-sso","status":"publish","type":"post","link":"https:\/\/chat-messenger.com\/en\/manual\/camserver\/iis-sso","title":{"rendered":"SSO using IIS Integrated Windows Authentication"},"content":{"rendered":"

Please use the following in the newly installed environment.<\/p>\n\n\n

\t\t\t
\n\t\t\t\t
\n\t\t\t\t\tChat&Messenger for web conferencing<\/span>\n\t\t\t\t\t
\"\"<\/figure><\/div>\t\t\t\t\t
\n\t\t\t\t\t\tSSO with Integrated Windows Authentication | Chat&Messenger Web Conferencing<\/a>\n\t\t\t\t\t\tOverview: In an Active Directory environment, using Integrated Windows Authentication (Kerberos) allows users to use their existing Windows login credentials to access C&M (Command & Management) systems, eliminating the need for additional login credentials\u2026<\/span>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\n

Overview of Integrated Windows Authentication<\/h2>\n\n\n\n

Integrated Windows Authentication (IWA) is a mechanism that automatically provides user authentication information to IIS when IIS and the user are logged in to the same domain. When you create a site with ASP.NET C#, you can determine whether a user has been authenticated and obtain information about authenticated users.<\/p>\n\n\n\n

This allows users to access web applications hosted on (or integrated with) IIS without any additional login steps and enables SSO integration with other application servers. <\/p>\n\n\n\n

\n
\n

*If a user is not part of the same domain or is unauthenticated and accesses the IIS page, a sign-in dialing message will be displayed. If authentication is not performed correctly, an HTTP Error 401.1 \u2013 Unauthorized will be displayed.<\/p>\n<\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

SSO (Single Sign On) Flow<\/h2>\n\n\n\n

The Chat&Messenger On-Premise Ultimate plan allows SSO via Integrated Windows Authentication. The SSO flow is as follows:<\/p>\n\n\n\n

\n
\n
  1. The client first accesses the Integrated Windows Authenticated page \/cam-iissso.<\/li>
  2. On the \/cam-iissso page, ASP.NET determines whether the user is authenticated and connects to the CAMServer.<\/li>
  3. The CAMServer performs an LDAP search to confirm that the user is a valid AD user, generates an ssoToken (a unique random value of 30 bytes or more) and a URL to access the CAMServer, and sends a redirect request.<\/li>
  4. Access the CAMServer and authenticate using the ssoToken. If authentication is successful, a session ID for API access will be assigned.<\/li><\/ol>\n<\/div>\n\n\n\n
    \n
    \"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

    The user ID of the user who uses SSO must match the UserPrincipalName in Active Directory and be registered in Chat&Messenger in advance. UserPrincipalName is I want to get a list of Active Directory users and create a CSV.<\/a> Please also refer to the following.<\/p>\n\n\n\n

    Requirements for achieving SSO<\/h2>\n\n\n\n

    Join Windows Server to Domain<\/h3>\n\n\n\n

    Please join the Windows Server running CAMServer\/IIS to the Active Directory domain.<\/p>\n\n\n\n

    To check the domain to which an existing Windows Server is joined, go to "Server Manager" \u2192 click "Local Server" on the left menu \u2192 click "Computer Name" and refer to the Domain column.<\/p>\n\n\n\n

    In addition, IIS should coexist with CAMServer on the same server and run on port 80. If you place a LoadBalancer in front of CAMServer, CAMServer will run on port 8080, so IIS can also use port 443.<\/p>\n\n\n\n

    Installing IIS<\/h3>\n\n\n\n
    \n
    \n

    Install IIS from the server roles. When installing IIS, check the following options in the role services selection options.<\/p>\n\n\n\n