LabApp - AD + IIS Demo

Demo Endpoints

GET /ad-demo/info Public Overview of the demo setup GET /ad-demo/whoami Auth Your Windows identity + AD groups + claims GET /ad-demo/protected LabAppUsers Protected resource — any LabAppUsers member GET /ad-demo/admin LabAppAdmins Admin-only resource — LabAppAdmins members only

How to Authenticate as a Demo User

Option 1 — Browser (easiest for demo)

Click any protected link above. Your browser will show a Windows credentials popup. Enter:

Username: lab.local\labuser1 Password: LabApp123!

If no popup appears, the browser may have tried and failed silently. Open the URL in an InPrivate/Incognito window to force a fresh prompt.

Option 2 — curl (for terminal demo)

Use --ntlm (or --negotiate for Kerberos) with the AD credentials:

curl -u "lab.local\labuser1:LabApp123!" --ntlm http://52.167.55.58/ad-demo/whoami

curl -u "lab.local\labadmin:LabApp123!" --ntlm http://52.167.55.58/ad-demo/admin

Option 3 — RDP into the DC or IIS VM

RDP as a domain user (lab.local\labuser1) — then open a browser on the VM. IIS recognises the logged-in Windows session automatically (Kerberos SSO, no popup).

Demo Users

labuser1

Password: LabApp123!

Groups: LabAppUsers

Can access /protected — NOT /admin

labuser2

Password: LabApp123!

Groups: LabAppUsers

labadmin

Password: LabApp123!

Groups: LabAppUsers + LabAppAdmins

Can access /protected AND /admin

Demo Flow

Hit /ad-demo/whoami without credentials → browser returns 401 Unauthorized

Authenticate as lab.local\labuser1 / LabApp123! (browser popup or curl --ntlm) → response shows your Windows identity and group memberships

Hit /ad-demo/protected → 200 OK (labuser1 is in LabAppUsers)

Hit /ad-demo/admin → 403 Forbidden (labuser1 is NOT in LabAppAdmins)

On the DC, run: Add-ADGroupMember -Identity LabAppAdmins -Members labuser1

Re-authenticate (new Incognito window or new curl request) → /ad-demo/admin now returns 200 OK

Explain: IIS Negotiate module → .NET Kerberos token → WindowsPrincipal → [Authorize(Roles="LabAppAdmins")]

Supporting Endpoints

GET /api/status Public SQL, Key Vault, domain join status GET /todos Public To-Do list — full CRUD against SQL Server GET /health Public App liveness check