What are the high level steps to authenticate users of an ASP.NET MVC application against Active Directory?
I presume something like:
Does the above look sensible, and if so, where do I put the valid user detection logic?
In my case a valid user is someone on a specific AD domain.
You can use the normal forms authentication to authenticate a user against an Active Directory, for that you just need you AD connection string:
<connectionStrings>
<add name="ADConn" connectionString="LDAP://YourConnection" />
</connectionStrings>
and add the Membership Provider to use this connection:
<membership defaultProvider="ADMembership">
<providers>
<add name="ADMembership"
type="System.Web.Security.ActiveDirectoryMembershipProvider,
System.Web,
Version=2.0.0.0,
Culture=neutral,
PublicToken=b03f5f7f11d50a3a"
connectionStringName="ADConn"
connectionUsername="domain/user"
connectionPassword="pwd" />
</providers>
</membership>
you will need to use username@domain to successfully authenticate the user.
Here is something to get you started
If you start your project new, you can always select Intranet application from the template and all is taken care for you
If you want to do it manually, you need to change:
for detailed info on doing this on IIS7/8 and IISExpress:
IIS 7 & IIS 8
- Open IIS Manager and navigate to your website.
- In Features View, double-click Authentication.
On the Authentication page, select Windows authentication. If Windows authentication is not an option, you'll need to make sure Windows authentication is installed on the server.
To enable Windows authentication on Windows: a) In Control Panel open "Programs and Features". b) Select "Turn Windows features on or off". c) Navigate to Internet Information Services > World Wide Web Services > Security and make sure the Windows authentication node is checked.
To enable Windows authentication on Windows Server: a) In Server Manager, select Web Server (IIS) and click Add Role Services b) Navigate to Web Server > Security and make sure the Windows authentication node is checked.
In the Actions pane, click Enable to use Windows authentication.
- On the Authentication page, select Anonymous authentication.
- In the Actions pane, click Disable to disable anonymous authentication.
IIS Express
- Right click on the project in Visual Studio and select Use IIS Express.
- Click on your project in the Solution Explorer to select the project.
- If the Properties pane is not open, open it (F4).
- In the Properties pane for your project: a) Set "Anonymous Authentication" to "Disabled". b) Set "Windows Authentication" to "Enabled".
In your web.config
have something like
<system.web>
<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>
</system.web>
and that's it!
Now, when you want the user identity, just call
@User.Identity.Name
and this will show you the Domain\Username
like for me :
Here is something to get you started