Windows Authentication for /apps

Preferred: native per-app auth (0.7+)

1. Install or upgrade iVistaar (keep the existing data\ folder on upgrade).
2. Ensure the server is domain-joined and the IIS Windows Authentication role is installed.
3. On Connect, check Require Windows Authentication, or open an existing project → Windows Authentication → enable and save.
4. Optionally list allowed AD groups. Empty = any authenticated domain user.

iVistaar configures the IIS application for that slug (Anonymous off, Windows Auth on, authorization rules) without relying on hand-edited web.config. Settings survive redeploy.

Your app reads the user as described in Using Windows identity in your app.

Upgrade behaviour

Existing apps stay auth off until an operator opts in. Overlay-extract the new zip over the install root, keep data\, re-run the service installer, and use the same admin password as before.

Outer IIS recipe (site-wide / ARR)

Still useful when you want one authenticating front door for all /apps before traffic reaches the gateway.

Prerequisites

• iVistaar in service mode (install-admin-service.cmd)
• IIS with Windows Authentication, URL Rewrite, and ARR
• Domain-joined server (or NTLM lab)

Pattern

• Gateway: http://127.0.0.1:8080/
• IIS HTTPS site: org URL → rewrite /apps to the gateway after Windows Auth

<!-- illustrative ARR rewrite -->
<rule name="iVistaar Apps" stopProcessing="true">
  <match url="^apps(/.*)?" />
  <action type="Rewrite" url="http://127.0.0.1:8080/{R:0}" />
  <serverVariables>
    <set name="HTTP_X_FORWARDED_PROTO" value="https" />
    <set name="HTTP_X_FORWARDED_HOST" value="{HTTP_HOST}" />
  </serverVariables>
</rule>

Enable Windows Auth on the IIS site (Anonymous disabled). For identity into Python, prefer native per-app auth or ensure ARR passes logon user into the backend so the gateway can inject X-IVistaar-Remote-User.

Service account

.\scripts\install-admin-service.cmd -Port 8080 -ServiceUser "DOMAIN\ivistaar-svc"

Installer prompts for the password. Grant that account rights on the install tree, data\, logs\, and apps root.