我应该使用哪种安全性？

Question

I am making an intranet mvc app for in-house use. Only other guy in the shop is the server tech. I am told we have a domain controller and we use AD, every user is in groups. I'm pretty sure we use windows authentication (based on we have to log in to our workstation.

I'm not sure if I should be using the UserPrincipal in Directory Services, or the Current.User stuff in HTTPContext, or something else, for authenticating users. Only people in certain AD groups should be able to open the app.

Obviously I know nothing about app security stuff. I plan to hit the books, as soon as I figure out which "technology" I should be using. I also need to check users against specific groups. I almost had that figured out, but I am getting false when I know it should be true.

        if (HttpContext.Current.User.IsInRole("MyADGroup"))
        {
            IsAdmin = true;   //keeps returning false.
        }

So what should I be looking into?

Answer 1

You can use this example to help you get started with Active Directory Roles.

Since the application is in-house, you don't want to stray far from Windows Authentication, but I do recommend looking into LDAP.

Connecting to an LDAP Server

Good luck!

Answer 2

You can hook up the internal application to use users and groups from AD by using the ActiveDirectoryMembershipProvider . Then simply authenticate against the provider instances ( Membership.ValidateUser ). This allows you to use AD as a backing store but isolates your application from an explicit dependence on it. This will also populate the UserPrincipal on the HttpContext.

I would recommend using this with a standard login form, though IIS will allow you to configure Windows authentication for the entire site. Using a standard login form along with AD-backed authentication allows you to maintain the decoupling and also expose some parts of the site as public pages by allowing anonymous access. This can be useful for things like application help and FAQs which might be useful to someone trying to log on but either disallowed by permission or using the incorrect credentials. Provides a better user experience as well.