> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrated with Active Directory

> WebAPI authentication Active Directory

## SuperOffice Users

To integrate with Active Directory, you need to set up your SuperOffice users as Active Directory users.

* *web.config* must define and configure the [ActiveDirectoryCredentialPlugin section][2].
* Your SuperOffice users need to be linked to Active Directory users.

## SuperOffice web.config

You must explicitly [enable the authentication methods][1] you want to use in the *web.config* file.

```XML theme={null}
<WebApi>
  <add key="AuthorizeWithImplicit" value="true" />
</WebApi>
```

<Note>
  `AuthorizeWithImplicit` must be **true**; otherwise, the Active Directory authentication method will not work. It adds the `WWW-Authenticate: Negotiate` header that kicks off Windows authentication.
</Note>

## IIS configuration

1. Open the IIS Configuration tool and select the SuperOffice application.

2. In IIS, navigate to the application hosting SuperOffice web client.

3. Enable Windows Authentication, and disable the others.

   ![iis-authentication-windows -screenshot][img1]

4. Click **Advanced Settings** to enable Kernel-mode authentication.

   ![iis-kernel-mode-auth -screenshot][img2]

5. Click **Providers** to ensure that **Negotiate** is the first enabled provider.

   ![iis-auth-providers -screenshot][img3]

Your SuperOffice and WebAPI are now accessible without logging in.

The HTTP.sys kernel driver will stop unauthenticated requests before they reach ASP.net and send back an ActiveDirectory response that the browser can use to log in using its windows identity.

Accessing `/api/v1/user/currentPrincipal` via Chrome or Edge should automatically log you in, and return the current user's info.

[1]: ../../web-config/webapi

[2]: ../../install/netserver/setup-rest#integrated-with-active-directory

[img1]: /media/loc/en/onsite/iis-authentication-windows.png

[img2]: /media/loc/en/onsite/iis-kernel-mode-auth.png

[img3]: /media/loc/en/onsite/iis-auth-providers.png


## Related topics

- [NetServer Security element](/en/onsite/web-config/security.md)
- [Deploy SuperOffice securely onsite](/en/onsite/security/secure-deployment-guide.md)
- [SuperOffice.config](/en/onsite/install/win-client/superoffice-config.md)
- [Configure SuperOffice REST WebAPI](/en/onsite/install/netserver/setup-rest.md)
- [NSCredentialsGroup](/en/automation/crmscript/reference/CRMScript.NetServer.NSCredentialsGroup.md)
- [Namespace CRMScript.NetServer](/en/automation/crmscript/reference/CRMScript.NetServer.md)