asp.net mvc - wrong user/password didn't checked at AD -

i have created mvc 5 application windows authentication,

<authentication mode="windows" /> <authorization>   <deny users="?" /> </authorization> 

i have below code user's display name along want validation,

protected void session_start(object sender, eventargs e)     {          if (context.user != null)         {             mapuseraddetails(context.user);         }     }      private void mapuseraddetails(iprincipal user)     {          using (hostingenvironment.impersonate())         using (var domain = new principalcontext(contexttype.domain, "test.com"))         using (var usr = userprincipal.findbyidentity(domain, user.identity.name))         {             if (usr == null)             {                 return;             }              session.add("userdisplayname", usr.displayname);         }     } 

now hosted app iis windows authentication enabled. when browsing it, it's prompt username , password,

question,

even entering wrong username/password or doesn't fill anything, it's able fetch display name.

how restrict this? user/pass must validate against ad. please suggest. thanks!

it sounds iis configuration issue , not code.

to troubleshoot:

• check if ie behaves differently
• make sure iis has windows authentication enabled , not e.g. anonymous (see receiving login prompt using integrated windows authentication)
• make sure page has no other resources (e.g. images) used other location requires authentication (maybe prompt not page resources embedded it)
• check browser settings (e.g. in ie site might need added intranet zone, or "automatically logon current username , password" not enabled)