{"id":11454,"date":"2025-01-12T14:00:44","date_gmt":"2025-01-12T05:00:44","guid":{"rendered":"https:\/\/chat-messenger.com\/?p=11454"},"modified":"2026-03-12T10:42:36","modified_gmt":"2026-03-12T01:42:36","slug":"iis-sso","status":"publish","type":"post","link":"https:\/\/chat-messenger.com\/en\/manual\/camserver\/iis-sso","title":{"rendered":"SSO using IIS Integrated Windows Authentication"},"content":{"rendered":"<p class=\"is-style-icon_info\">\u65b0\u3057\u304f\u5c0e\u5165\u3059\u308b\u74b0\u5883\u3067\u306f\u4ee5\u4e0b\u3092\u3054\u5229\u7528\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n<div class=\"swell-block-postLink\">\t\t\t<div class=\"p-blogCard -external\" data-type=\"type3\" data-onclick=\"clickLink\">\n\t\t\t\t<div class=\"p-blogCard__inner\">\n\t\t\t\t\t<span class=\"p-blogCard__caption\">Chat&amp;Messenger for web conferencing<\/span>\n\t\t\t\t\t<div class=\"p-blogCard__thumb c-postThumb\"><figure class=\"c-postThumb__figure\"><img src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2021\/05\/cam_slide_ja_hojo.png\" alt=\"\" class=\"c-postThumb__img u-obf-cover\" width=\"320\" height=\"180\"><\/figure><\/div>\t\t\t\t\t<div class=\"p-blogCard__body\">\n\t\t\t\t\t\t<a class=\"p-blogCard__title\" href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/windows-auth\/\" target=\"_blank\" rel=\"noopener noreferrer\">\u7d71\u5408Windows\u8a8d\u8a3c\u3067\u306eSSO | Web\u4f1a\u8b70\u306e Chat&amp;Messenger<\/a>\n\t\t\t\t\t\t<span class=\"p-blogCard__excerpt\">\u6982\u8981 Active Directory \u74b0\u5883\u3067\u306f\u3001\u7d71\u5408 Windows \u8a8d\u8a3c\uff08Kerberos\uff09 \u3092\u5229\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u30e6\u30fc\u30b6\u30fc\u304c Windows \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u8a8d\u8a3c\u60c5\u5831\u3092\u305d\u306e\u307e\u307e\u5229\u7528\u3057\u3001C&#038;M \u306b\u8ffd\u52a0\u30ed\u30b0\u30a4&#8230;<\/span>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\n<h2>Overview of Integrated Windows Authentication<\/h2>\n\n\n\n<p>Integrated Windows Authentication (IWA) is a mechanism that automatically provides user authentication information to IIS when IIS and the user are logged in to the same domain. When you create a site with ASP.NET C#, you can determine whether a user has been authenticated and obtain information about authenticated users.<\/p>\n\n\n\n<p>This allows users to access web applications hosted on (or integrated with) IIS without any additional login steps and enables SSO integration with other application servers. <\/p>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p>*If a user is not part of the same domain or is unauthenticated and accesses the IIS page, a sign-in dialing message will be displayed. If authentication is not performed correctly, an HTTP Error 401.1 \u2013 Unauthorized will be displayed.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full\"><img width=\"1849\" height=\"781\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image.png\" alt=\"\" class=\"wp-image-11455\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h2>SSO (Single Sign On) Flow<\/h2>\n\n\n\n<p>The Chat&amp;Messenger On-Premise Ultimate plan allows SSO via Integrated Windows Authentication. The SSO flow is as follows:<\/p>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<ol><li>The client first accesses the Integrated Windows Authenticated page \/cam-iissso.<\/li><li>On the \/cam-iissso page, ASP.NET determines whether the user is authenticated and connects to the CAMServer.<\/li><li>The CAMServer performs an LDAP search to confirm that the user is a valid AD user, generates an ssoToken (a unique random value of 30 bytes or more) and a URL to access the CAMServer, and sends a redirect request.<\/li><li>Access the CAMServer and authenticate using the ssoToken. If authentication is successful, a session ID for API access will be assigned.<\/li><\/ol>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full\"><img width=\"1377\" height=\"1246\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-19.png\" alt=\"\" class=\"wp-image-11532\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p class=\"is-style-icon_info\">The user ID of the user who uses SSO must match the UserPrincipalName in Active Directory and be registered in Chat&amp;Messenger in advance. UserPrincipalName is <a href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/active-directory-ldap\/#Get-ADUser\">I want to get a list of Active Directory users and create a CSV.<\/a> Please also refer to the following.<\/p>\n\n\n\n<h2>Requirements for achieving SSO<\/h2>\n\n\n\n<h3>Join Windows Server to Domain<\/h3>\n\n\n\n<p>Please join the Windows Server running CAMServer\/IIS to the Active Directory domain.<\/p>\n\n\n\n<p class=\"is-style-crease\">To check the domain to which an existing Windows Server is joined, go to &quot;Server Manager&quot; \u2192 click &quot;Local Server&quot; on the left menu \u2192 click &quot;Computer Name&quot; and refer to the Domain column.<\/p>\n\n\n\n<p>In addition, IIS should coexist with CAMServer on the same server and run on port 80. If you place a LoadBalancer in front of CAMServer, CAMServer will run on port 8080, so IIS can also use port 443.<\/p>\n\n\n\n<h3>Installing IIS<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p>\u30b5\u30fc\u30d0\u306e\u5f79\u5272\u304b\u3089IIS\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304f\u3060\u3055\u3044\u3002IIS\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6642\u306b\u3001\u5f79\u5272\u30b5\u30fc\u30d3\u30b9\u306e\u9078\u629e\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u4ee5\u4e0b\u30c1\u30a7\u30c3\u30af\u3092\u884c\u3046\u3002<\/p>\n\n\n\n<ul><li>Windows Authentication<\/li><li>ISAPI Filters<\/li><li>ISAPI \u62e1\u5f35<\/li><\/ul>\n\n\n\n<p class=\"is-style-icon_pen\"><span class=\"swl-fz u-fz-xs\">ISAPI Filter: Supports loading extension modules in IIS. Required to load AspNetCoreModuleV2.<br><br>ISAPI \u62e1\u5f35: IIS \u306b ISAPI \u62e1\u5f35\u6a5f\u80fd\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002 AspNetCoreModuleV2 \u306e\u52d5\u4f5c\u306b\u5fc5\u9808\u3067\u3059\u3002 <\/span><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"1399\" height=\"849\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/03\/image-5.png\" alt=\"\" class=\"wp-image-11669\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3>Install ASP.NET Core Hosting Bundle<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/dotnet.microsoft.com\/ja-jp\/download\/dotnet\/8.0\" target=\"_blank\">ASP.NET Core Hosting Bundle<\/a> \u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u5f8c\u3001IIS\u3092\u518d\u8d77\u52d5\u3057\u3066\u30cf\u30f3\u30c9\u30e9\u30fc\u30de\u30c3\u30d4\u30f3\u30b0 \u306b AspNetCoreModuleV2 \u304c\u5b58\u5728\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<p class=\"is-style-icon_pen\"><span class=\"swl-fz u-fz-xs\">IIS \u74b0\u5883\u3067 ASP.NET Core \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u30db\u30b9\u30c8\u3059\u308b\u5834\u5408\u3001 ASP.NET Core Hosting Bundle \u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3060\u3051\u3067OK\u3067\u3059\u3002<\/span><\/p>\n\n\n\n<p class=\"is-style-icon_pen\"><span class=\"swl-fz u-fz-xs\">ASP.NET Core \u30e9\u30f3\u30bf\u30a4\u30e0\u3092\u30d0\u30fc\u30b8\u30e7\u30f3\u30a2\u30c3\u30d7\u3059\u308b\u5834\u5408\u3082\u3001\u540c\u69d8\u306bHosting Bundle\u306e\u307f\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/span><span class=\"swl-fz u-fz-xs\">\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u3067\u3069\u306e ASP.NET Core \u30e9\u30f3\u30bf\u30a4\u30e0 \u3067\u5b9f\u884c\u3057\u3066\u3044\u308b\u304b\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/span><br><span class=\"swl-fz u-fz-xs\">dotnet &#8211;list-runtimes<\/span><br><\/p>\n\n\n\n\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full\"><img width=\"1336\" height=\"845\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2026\/01\/image.png\" alt=\"\" class=\"wp-image-12475\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"986\" height=\"206\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-4.png\" alt=\"\" class=\"wp-image-11459\"\/><figcaption>Restart IIS<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"965\" height=\"310\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-5.png\" alt=\"\" class=\"wp-image-11460\"\/><figcaption>Handler Mapping<\/figcaption><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3>Add application (cam-iissso)<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p> Add the cam-iissso application to the Default Web Site.<\/p>\n\n\n\n<ul><li>Alias: cam-iissso <\/li><li>Physical Path: \\sys\\cam-iissso-net8.0<\/li><\/ul>\n\n\n\n\n\n\n\n\n\n\n\n<p>Also, grant the IIS_IUSRS group viewing permissions (Read &amp; Execute, List Folder Contents, Read) to the cam-iissso-net8.0 folder.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"685\" height=\"441\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-18.png\" alt=\"\" class=\"wp-image-11528\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img width=\"1012\" height=\"588\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-16.png\" alt=\"\" class=\"wp-image-11521\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3>Enable Windows Authentication<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p>Right-click &quot;Windows Authentication&quot; and select &quot;Enable.&quot;<\/p>\n\n\n\n<p class=\"is-style-icon_info\"> If &quot;Anonymous Authentication&quot; is enabled, please disable it.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"944\" height=\"360\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-8.png\" alt=\"\" class=\"wp-image-11463\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3 id=\"internet-options-settings\">Internet Options Settings<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<h4>Add the site served by IIS to the Intranet Zone <\/h4>\n\n\n\n<p>Select Internet Options, click the &quot;Security&quot; tab, and select &quot;Local intranet.&quot; Click the &quot;Sites&quot; button, select &quot;Advanced Settings,&quot; and add the URL of the site.<\/p>\n\n\n\n<h4>Check for automatic logon <\/h4>\n\n\n\n<p>Click &quot;Custom Level&quot; and make sure that &quot;Automatic logon in Intranet zone&quot; is selected under &quot;User Authentication&quot; -&gt; &quot;Logon&quot;.<\/p>\n\n\n\n<p class=\"is-style-icon_pen\"><span class=\"swl-fz u-fz-s\">This setting is required on all C&amp;M user client terminals, but it can be centrally managed using the Group Policy Management Console.<\/span><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"1290\" height=\"994\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-9.png\" alt=\"\" class=\"wp-image-11464\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"619\" height=\"774\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-10.png\" alt=\"\" class=\"wp-image-11465\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3>LDAP Settings<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p>If you want to use IIS for single sign-on,<a href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/active-directory-ldap\/#LDAP-config\" target=\"_blank\" rel=\"noreferrer noopener\">LDAP Settings<\/a>(LDAPUrl, LDAPBaseDN, AD user to perform proxy authentication) are required. <\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img width=\"1449\" height=\"951\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-12.png\" alt=\"\" class=\"wp-image-11492\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3 id=\"fqdn-spn\">Access via FQDN (fully qualified domain name) and register SPN<\/h3>\n\n\n\n<p>This is not necessary if you access the IIS Windows Integrated Authentication page using a host name (NetBIOS name), but you must register an SPN if you access it using an FQDN (fully qualified domain name, e.g., sso.example.com).<\/p>\n\n\n\n<p>SPN (Service Principal Name) is a name that uniquely identifies a specific service on Active Directory in Kerberos authentication. When accessing with FQDN, registering SPN allows the client to correctly request a Kerberos ticket for the service to be accessed.<\/p>\n\n\n\n<p>for example <code>https:\/\/sso.example.com<\/code> When accessing, the client (browser) requests a ticket from Active Directory, saying &quot;I want to connect to a service called HTTP\/sso.example.com.&quot; Active Directory checks which account the SPN is associated with and issues the corresponding service ticket. If the SPN is not registered correctly, Kerberos authentication will fail, resulting in the display of an authentication dialog box.<\/p>\n\n\n\n<p>The SPN registration is done on the computer account hosting IIS. For example,<code>ad<\/code> For IIS running with the host name, register the SPN as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>setspn -S HTTP\/sso.example.com ad$<\/code><\/pre>\n\n\n\n<p>Once registered, you can check with the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>setspn -L ad$<\/code><\/pre>\n\n\n\n<p>This result <code>HTTP\/sso.example.com<\/code> If it is displayed, the SPN registration was successful.<\/p>\n\n\n\n<h3>Cannot be used in HTTP proxy connection environment<\/h3>\n\n\n\n<p>Please note that SSO is not available in HTTP proxy environments.<\/p>\n\n\n\n<h2>Configuration in a LoadBalancer + SSL environment<\/h2>\n\n\n\n<p>If you are using IIS Integrated Windows Authentication in a LoadBalancer + SSL environment, please refer to the following blog article.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-web\u4f1a\u8b70\u306e-chat-amp-messenger wp-block-embed-web\u4f1a\u8b70\u306e-chat-amp-messenger\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/chat-messenger.com\/blog\/windowsauthentication-loadbalancer-ssl\n<\/div><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-web\u4f1a\u8b70\u306e-chat-amp-messenger wp-block-embed-web\u4f1a\u8b70\u306e-chat-amp-messenger\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/chat-messenger.com\/blog\/windowsauthentication-setspn\n<\/div><\/figure>","protected":false},"excerpt":{"rendered":"<p>\u65b0\u3057\u304f\u5c0e\u5165\u3059\u308b\u74b0\u5883\u3067\u306f\u4ee5\u4e0b\u3092\u3054\u5229\u7528\u304f\u3060\u3055\u3044\u3002 \u7d71\u5408Windows\u8a8d\u8a3c\u306e\u6982\u8981 \u7d71\u5408Windows\u8a8d\u8a3c\uff08Integ [&hellip;]<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"swell_btn_cv_data":""},"categories":[17],"tags":[],"_links":{"self":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/11454"}],"collection":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/comments?post=11454"}],"version-history":[{"count":10,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/11454\/revisions"}],"predecessor-version":[{"id":12670,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/11454\/revisions\/12670"}],"wp:attachment":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/media?parent=11454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/categories?post=11454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/tags?post=11454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}