title: Windows Authentication and Angular 7 application
body: <p>I have developed intranet application</p>
  
  <p>Backend: ASP.NET WEB API-2 (All controllers have Authorize attribute), 
  Frontend: Angular 7 (after prod build I moved generated scripts to my backend project):</p>
  
  <pre><code>....
    &lt;app-root&gt; 
        &lt;div id="preloader"&gt;&lt;/div&gt;
    &lt;/app-root&gt;
  
  
    &lt;script type="text/javascript" src="~/Scripts/SPA/runtime.26209474bfa8dc87a77c.js"&gt;&lt;/script&gt;
    &lt;script type="text/javascript" src="~/Scripts/SPA/es2015-polyfills.bda95d5896422d031328.js" nomodule&gt;&lt;/script&gt;
    &lt;script type="text/javascript" src="~/Scripts/SPA/polyfills.8bbb231b43165d65d357.js"&gt;&lt;/script&gt;
    &lt;script type="text/javascript" src="~/Scripts/SPA/main.122a2bd84f391ab8df1d.js"&gt;&lt;/script&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p>The problem is am getting prompted to enter my username/password  after deployment to server.If user enters credentials it works perfectly, but I want the application to grab logged user automaticaly.</p>
  
  <p>this is my web.config</p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;
     &lt;authorization&gt;
       &lt;deny users="?" /&gt;
     &lt;/authorization&gt;
  </code></pre>
  
  <p>this is my interceptor in angular </p>
  
  <pre><code>import { Injectable } from '@angular/core';
  import { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent } from '@angular/common/http';
  import { Observable } from 'rxjs';
  
  @Injectable()
  export class CredentialsInterceptor implements HttpInterceptor {
      intercept(request: HttpRequest&lt;any&gt;, next: HttpHandler): Observable&lt;HttpEvent&lt;any&gt;&gt; {
          request = request.clone({
              withCredentials: true
          });
  
          return next.handle(request);
      }
  }
  
  </code></pre>
  
  <p>in Visual Studio 2019 project settings </p>
  
  <p>Anonymous Authentication:Enabled</p>
  
  <p>Windows Authentication:Enabled</p>
  
  <p>Managed Pipeline Mode: Integrated</p>
  
  <p>Global.asax</p>
  
  <pre><code>protected void Application_BeginRequest(Object sender, EventArgs e)
         {
             //Preflight request comes with HttpMethod OPTIONS
             //The following line solves the error message
             //HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "http://localhost:4202");
             HttpContext.Current.Response.AddHeader("Access-Control-Allow-Credentials", "true");
             if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
             {
                 HttpContext.Current.Response.AddHeader("Cache-Control", "no-cache");
                 HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST");
                 HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Pragma, Cache-Control, Authorization");
                 HttpContext.Current.Response.End();
             }
         }
  </code></pre>