使用ASP.NET身份验证和LDAP的身份验证/授权

Question

I have an existing ASP.NET application that uses LDAP for authentication and ASP.NET membership for authentication and authorization.

So an LDAP user could choose to authenticate either using his LDAP credentials, or ASP.NET membership credentials. A non LDAP user can only authenticate using LDAP credentials.

I now want to create a Web API project that uses a similar approach for authentication and authorization.

Using VS 2013, I created a new Web API project that uses the Individual Accounts option for authentication.

I've modified the GrantResourceOwnerCredentials method in the Providers\\ApplicationOAuthProvider.cs file.

Before

...
IdentityUser user = await userManager.FindAsync(context.UserName, context.Password);

if (user == null)
{
    context.SetError("invalid_grant", "The user name or password is incorrect.");
    return;
}
...

After

...
IdentityUser user;

if (AuthenticateActiveDirectory(context.UserName, context.Password, "MyADDomain"))
{
    user = await userManager.FindByNameAsync(context.UserName);
}
else
{
    user = await userManager.FindAsync(context.UserName, context.Password);
}

if (user == null)
{
    context.SetError("invalid_grant", "The user name or password is incorrect.");
    return;
}
...

And the AuthenticateActiveDirectory method is:

   private bool AuthenticateActiveDirectory(string userName, string password, string domain)
   {
     bool validation;
     try
     {
        var lcon = new LdapConnection(new LdapDirectoryIdentifier((string)null, false, false));
        var nc = new NetworkCredential(userName, password, domain);
        lcon.Credential = nc;
        lcon.AuthType = AuthType.Negotiate;
        lcon.Bind(nc);
        validation = true;
     }
     catch (LdapException)
     {
        validation = false;
     }
     return validation;
   }

This works, but is it the best way of doing it or is there a better way?

Answer 1

It's fine. Couple things come to mind:

• If you have multiple domains in your forest (or ever will support that), username isn't unique across the forest - just the domain. Looks like you're keying on username today.
• For your LdapConnection , I assume the null server name is just for show here? Rather than hardcoding one, you can use the S.DS.AD namespace to find a domain controller for you.
• You'd probably want AuthType.Basic rather than Negotiate here. You'll want to make sure your connection is LDAP/S since the creds will be cleartext.