iVistaar

iVistaar

Using Windows identity in your app

When Windows Authentication is enabled for a published app, iVistaar forwards the authenticated browser user into the Python process. Use it for audit fields and authorization — not a shared password.

Enable auth for the app

  1. On Connect, check Require Windows Authentication, or open an existing project and use the Windows Authentication card.
  2. Optionally list AD groups (comma-separated). Empty means any authenticated domain user.
  3. Server must be domain-joined and the IIS Windows Authentication role installed.

Existing apps stay open until an operator opts in. Upgrade does not flip auth on automatically.

Contract (WSGI environ)

Prefer the iVistaar header; fall back to classic REMOTE_USER:

user = (
    environ.get("HTTP_X_IVISTAAR_REMOTE_USER")
    or environ.get("REMOTE_USER")
)
# e.g. "CONTOSO\\jsmith"

Client-supplied copies of these headers are stripped at the proxy. Only values from the authenticated edge are injected.

Flask example

from flask import Flask, request

app = Flask(__name__)

@app.get("/")
def home():
    user = (
        request.environ.get("HTTP_X_IVISTAAR_REMOTE_USER")
        or request.environ.get("REMOTE_USER")
        or "anonymous"
    )
    return f"Hello, {user}"

@app.post("/submit")
def submit():
    actor = (
        request.environ.get("HTTP_X_IVISTAAR_REMOTE_USER")
        or request.environ.get("REMOTE_USER")
    )
    # record actor on the row / event
    ...

Groups

v1 enforces groups at the IIS edge (Authorization Rules). The app receives the username. If you need group membership inside Python, query AD yourself with the username, or wait for a later helper environ key.

Related