使用活动目录的MVC 5身份验证，没有单一登录

Question

I am creating an intranet site in MVC 5 and I want it to authenticate against Active Directory. But I don't want it to use single sign on so the Windows Authentication option doesn't work. I want the users to be required to sign in and out by typing in their credentials each time like using Individual User Accounts but I want it to authenticate against AD.

I see the new On-Premise Organization Accounts but I am not finding much documentation on it. And since it requires work from our IT group to get it up and running I don't want to enable this option without knowing for sure if it will allow the users to enter in credentials to sign in and out.

If not how do I use Individual users accounts against AD? All articles I can find are for MVC4...

Answer 1

I think the new ADAL v2 RC has added a username and password authentication overload to the GetTokenBy which is what you would be looking for I guess...

UserCredential uc = new UserCredential(user, password);

public AuthenticationResult AcquireToken(string resource, string clientId, UserCredential userCredential);

public Task AcquireTokenAsync(string resource, string clientId, UserCredential userCredential);

Do check the link.

Cheers, Bala

Answer 2

the link you provided still requires collaboration from the IT department given that they'd have 1) to set up ADFS and 2) to federate ADFS with an AAD tenant. Also, that flow should not be used on a server (for security reasons).

Hi user3838574, how the on-premises organization account project will behave depends on how your IT decides to run their ADFS instance. Given that your requirement is the polar opposite of the conventional requirement (seamless SSO if the user already signed in the domain network) you can expect some extra work :-) In the most common deployments, accessing ADFS from the intranet will default the endpoint to windows integrated authentication - the behavior you want to avoid. However: if your IT has ADFS on Windows Server 2012 R2, I believe there are features you can leverage for achieving the behavior you want. Take a look at http://technet.microsoft.com/en-us/library/dn486781.aspx and see if you can find something that works for you. If you still have issues I can point the ADFS team to this thread. HTH V.