PowerClient provides built-in support for Windows authentication. With this feature, apps can use the Windows login that users already entered when logging in to their computers. As a result, users no longer need to manage a separate username and password for the app.
In the PowerClient project painter > Security page, choose the authentication mode
under Windows authentication (client) for file
download. This setting determines the authentication used
when downloading application files and is stored in
apprun.json on the server (remember to include
apprun.json when deploying the app) and
pbapp.ini on the client.
Three modes are available:
-
Anonymous (0)– Users can access the application without providing any credentials. This mode is generally used for testing or for resources intended to be publicly accessible. It provides no security protection and should not be used in production unless required. -
Integrated (1)– The app automatically uses the current Windows login. If this fails, a login dialog appears. -
UserPassword (2)– The user is prompted to enter Windows credentials. The user can choose to save their credentials by selecting "Remember me" in the login dialog for future use (and can remove the cached credentials through the Windows Credential Manager later).
Windows considers each type of access — such as opening a website, downloading application files, or calling a Web API — as an independent resource. For security, Windows performs a separate authentication check for each resource. That means even though all these actions belong to the same application, Windows still verifies credentials separately, ensuring that access to one resource does not automatically grant access to another.
Because of this, users may see more than one login prompt, in the following scenarios within PowerClient:
-
Scenario 1: Accessing the Website
When opening the Web Portal, IIS or a proxy may ask for Windows login (often shown as "Sign in to access this site"). This is standard Windows behavior.
-
When it appears: If IIS has enabled Windows authentication and the application is accessed from a web browser.
-
How to avoid it: This prompt is NOT related to the PowerServer project settings. You can change the browser settings to avoid this prompt, or launch the application from a desktop shortcut (no prompt).
-
-
Scenario 2: Downloading the app via launcher
When the Cloud App Launcher downloads app files, it may ask for login. The dialog usually shows the launcher name (for example, "AppLauncher_V3").
-
When it appears: If IIS has enabled Windows authentication and the PowerServer app security is set to Windows authentication (User password).
-
How to avoid it: Change the PowerServer app security to Windows authentication (Integrated). Alternatively, if the user selected "Remember me" (not selected by default), the credentials will be cached and automatically reused on the client. Users can later remove these cached credentials through the Windows Credential Manager.
-
If you use IIS to host application files, configure it properly to enable Windows Authentication.
Step 1: Enable IIS Windows Authentication Feature
-
Open Server Manager on the Windows server.
-
Go to Add Roles and Features.
-
Under Server Roles, make sure Web Server (IIS) is installed.
-
In Role Services, enable Windows Authentication.
Step 2: Configure IIS Authentication for the Application
-
Open the IIS Manager and navigate to the application site.
-
Select Authentication under the IIS section.
-
Enable Windows Authentication.
-
Disable Anonymous Authentication if you want to force Windows login.
Step 3: Configure Authentication in PowerServer Project
After IIS has been set up, configure the authentication mode inside the PowerServer project:
-
In the project painter, go to the Security page.
-
For Web APIs, select the authentication mode under Web API authentication.
-
For app file downloads, select the authentication mode under Windows authentication (client) for file download.
