Angular 4启用Windows SSPI认证求助：Node.js部署应用报SPNEGO错误

Got it, let's work through this Windows SSPI authentication issue for your Angular app deployed on Node.js. That "spnego authentication not allowed for this client" error typically crops up when your Node.js server isn't configured properly to handle SSPI, or there's a mismatch in client/server settings. Here's a step-by-step solution:

1. 安装必要的依赖包 #

First, you'll need a Node.js library that handles SSPI authentication. The most reliable options are sspi or node-spnego. Install one via npm:

npm install sspi --save
# Or if you prefer using spnego directly:
npm install node-spnego --save

2. 配置Node.js服务器（以Express为例） #

Most Angular deployments use Express to serve static files and handle API requests. Here's how to add SSPI authentication middleware:

const express = require('express');
const { Sspi } = require('sspi');
const cors = require('cors');
const app = express();

// Configure CORS if your Angular app is on a different origin
app.use(cors({
  origin: 'http://your-angular-app-url', // Replace with your Angular app's domain
  credentials: true
}));

// SSPI authentication middleware
const sspiAuth = (req, res, next) => {
  const sspi = new Sspi({
    serviceName: 'HTTP', // Standard for web services; don't change this unless you know what you're doing
    hostName: process.env.HOSTNAME || 'localhost',
    realm: 'YOUR_COMPANY_DOMAIN.COM', // Replace with your Windows domain
    useNTLM: true, // Enable fallback to NTLM if Negotiate fails
  });

  const authHeader = req.headers.authorization;
  if (!authHeader) {
    // Trigger SSPI authentication request
    res.setHeader('WWW-Authenticate', 'Negotiate');
    return res.status(401).send('Authentication required');
  }

  sspi.authenticate(authHeader, (err, authData) => {
    if (err) {
      console.error('SSPI Auth Failed:', err);
      return res.status(401).send('Authentication failed');
    }

    // Attach authenticated user info to the request object
    req.user = {
      username: authData.userName,
      domain: authData.domainName
    };

    // Complete the authentication handshake if needed
    if (authData.contextResponse) {
      res.setHeader('WWW-Authenticate', `Negotiate ${authData.contextResponse}`);
    }
    next();
  });
};

// Apply SSPI auth to protected routes (e.g., your API endpoints)
app.use('/api', sspiAuth);

// Serve Angular's static build files
app.use(express.static('dist/your-angular-app-folder'));

// Start server
app.listen(3000, () => {
  console.log('Server running on port 3000');
});

3. Update Angular to send authentication credentials #

Your Angular app needs to tell the browser to automatically send Windows authentication credentials with requests. Add an HTTP interceptor:

import { Injectable } from '@angular/core';
import { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent } from '@angular/common/http';
import { Observable } from 'rxjs';

@Injectable()
export class AuthInterceptor implements HttpInterceptor {
  intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
    // Clone the request and enable credentials
    const authRequest = req.clone({
      withCredentials: true
    });
    return next.handle(authRequest);
  }
}

Register the interceptor in your app.module.ts:

import { HTTP_INTERCEPTORS } from '@angular/common/http';
import { AuthInterceptor } from './auth.interceptor';

@NgModule({
  providers: [
    {
      provide: HTTP_INTERCEPTORS,
      useClass: AuthInterceptor,
      multi: true
    }
  ]
})
export class AppModule { }

4. Troubleshoot the "spnego authentication not allowed for this client" error #

• Check server permissions: Ensure your Node.js server is running under a domain account (or a local account with permissions to handle SSPI). If testing locally, make sure your machine is joined to the domain.
• Browser settings: Add your server URL to the "Local Intranet" zone in IE/Edge (this allows automatic credential submission). For Chrome, start it with the flag --auth-server-whitelist="your-server-domain.com".
• Verify service name: The serviceName in the SSPI config must be HTTP for web services—don't change this unless you're using a non-standard service type.
• Cross-origin checks: If your Angular app and Node.js server are on different domains, double-check that CORS is configured to allow credentials (the credentials: true flag in the cors setup is critical).

5. Test the flow #

Start your Node.js server, then launch your Angular app. If you're on a domain-joined machine, the browser should automatically authenticate you using your Windows credentials. If testing locally, you'll see an NTLM login prompt. Once authenticated, you can access the user info in your Node.js routes via req.user.

内容的提问来源于stack exchange，提问作者FundooCoder