使用c＃中的vpn进行活动目录身份验证

Question

I am developing a web application that authenticate the user against an Active Directory Server. Now if I run my code from the development PC under the domain of that AD server, my code is running smoothly. We need to run the code from a totally different network using VPN and here the development PC is not into that AD. I am getting following error while trying to access the AD server.

The specified domain either does not exist or could not be contacted.

My VPN is working fine. I could access remote desktops using this VPN. I know a little tweak is required to solve the problem but could not find it. I went through following links but could not find any solution.

1. Domain Authentication from .NET Client over VPN

2. How do I get the Current User identity for a VPN user in a Windows forms app?

Following is my settings in web.config

<appSettings>
   <add key="LDAPPath" value="LDAP://DC=MYSERVER,DC=COM" />
   <add key="ADGroupName" value="Analyst"/>
</appSettings>

and here is my code

public class LdapAuthentication
{
    private string _path;
    private string _filterAttribute;

    public LdapAuthentication()
    {
        _path = System.Configuration.ConfigurationManager.AppSettings["LDAPPath"].ToString();
    }

    public bool IsAuthenticated(string username, string pwd)
    {
        try
        {
            DirectoryEntry entry = new DirectoryEntry(_path, username, pwd);

            entry.Path = _path;
            entry.Username = username;
            entry.Password = pwd;

            // Bind to the native AdsObject to force authentication.
            object obj = entry.NativeObject;

            DirectorySearcher search = new DirectorySearcher(entry);

            search.Filter = "(SAMAccountName=" + username + ")";
            search.PropertiesToLoad.Add("cn");
            SearchResult result = search.FindOne();

            if (null == result)
            {
                return false;
            }

            // Update the new path to the user in the directory.
            _path = result.Path;
            _filterAttribute = (string)result.Properties["cn"][0];
        }
        catch (Exception ex)
        {
            throw new Exception("Error authenticating user. " + ex.Message);
        }

        return true;
    }
}

Any help would be appreciated. Thank you.

Answer 1

I had a similar, though simpler problem. I had success in using the following code:

private bool DoLogin(string userName, string password)
{
    using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, "DomainName.com")) {
        bool isValid = pc.ValidateCredentials(userName, password);
        if (isValid) {
            // authenticated
            ...
            return true;
        }
        else {
            // invalid credentials
            ...
            return false;
        }
    }
}

Using the ".com" at the end of the domain name was important to get it working for me. Without it I got the same symptoms you describe.

Answer 2

I've just been grappling with this for a couple of hours. No problems when on the network, lots of problems when connecting via VPN. It seems that when you are connecting over a VPN, the 'connection string' for DirectoryEntry has to be a lot more precise. I finally got it to work with an LDAP address/connection string like this:

LDAP://ip_of_primary_domain_controller/fully qualified path of the container object where the binding user is located

So for example something like this worked for me:

DirectoryEntry directoryEntry = new DirectoryEntry(
      "LDAP://192.168.0.20/OU=Service Accounts,OU=Admin Accounts,DC=myserver,DC=com",
      "username@myserver.com", "password"); 

... where "username@myserver.com" is located in OU=Service Accounts,OU=Admin Accounts,DC=myserver,DC=com. If you use SysInternals ADExplorer (or similar) to search for your username, it will tell you the correct fully qualified path for the container.

See here for a long answer about exactly whats should be in the 'connection string': https://serverfault.com/a/130556