ASP.NET MVC中的自动或手动Active Directory身份验证

Question

I'm working on an asp.net mvc web app that is supposed to:

1. Automatically login someone if they are a valid user in Active Directory.
2. If the client is outside of the network (they're at home or whatever), allow them to manually login with their AD credentials through a login form.

I'm very new to AD authentication, I'm confused as to if I should be using Forms Authentication or Windows Authentication.

I have this in my web.config:

 <add name="ADConnect" connectionString="LDAP://[something]/CN=dhr,DC=[something],DC=net"  />

If I set: <authentication mode="Windows"> I can check User.Identity.IsAuthenticated in the controller to determine if they're logged in. If they're not, am I supposed to use this?:

 Membership.ValidateUser("someguy", "somepass");

I get an error about making a secure connection to the server if I run the above. I have this as my provider:

<membership defaultProvider="AspNetActiveDirectoryMembershipProvider">
  <providers>
    <clear />
    <add name="AspNetActiveDirectoryMembershipProvider" 
         type="System.Web.Security.ActiveDirectoryMembershipProvider"
         connectionStringName="ADConnect" attributeMapUsername="sAMAccountName"
         />

  </providers>
</membership>

Answer 1

Typically, network administrators prevent web applications that use windows authentication to expose to the internet due to security reasons. This is definitely possible, but you need to make sure that second scenario is valid and possible in your organization. A common scenario to connect from the internet is to use VPN which will log in you to the network (means you will be authenticated against AD).

To perform only authentication for the first scenario you do no need the AspNetActiveDirectoryMembershipProvider. An authentication (validation of user identity) usually only required to be set

• in web.config: authentication mode="Windows" and authorization
• on IIS: set integrated windows authentication to ON
• on IIS: if you have second scenario (or if you have different domains, etc) keep anonymous access as ON - it should prompt with standard login propmt;otherwise set it OFF