Azure Active Directory组织身份验证机制

Question

I have recently started on developing an ASP.NET MVC web app which uses organizational authentication on Azure Active Directory.

I followed this tutorial: http://www.asp.net/identity/overview/getting-started/developing-aspnet-apps-with-windows-azure-active-directory

And I managed to deploy the application and it runs correctly.

However, I'm still unsure of the underlying working mechanism of the Federation WS used to provide the Active Directory organization authentication.

The application immediately redirects the users to the Microsoft login site when the website is run before rendering the home page. I could not find any piece of codes in the application that make this happen. I tried to comment out the IdentityConfig method in Global.asax but the redirection is still happening.

I would like to know when and how does the application start the authentication process and is it possible and safe to suppress the authentication process until the Sign In hyperlink is clicked by the user.

Answer 1

For adding AD authentication to ASP.NET WebApps/VNext you can use the new ADAL Library, there are many samples available here https://github.com/AzureADSamples . You can use this for example: https://github.com/AzureADSamples/WebApp-WSFederation-DotNet , this is completely driven by user actions.

Answer 2

I found out that the solution is pretty easy. Just remove:

<system.web>
    <!-- remove/comment out
    <authorization>
      <deny users="?" />
    </authorization>
    --> 
</system.web>

in Web.config. This will tell WSFederationAuthenticationModule not to execute the redirection event and allow anonymous users in public pages.

Apply [Authorize] attribute to the action or controller when authentication is needed if you are developing in ASP.NET MVC.

If you are developing in ASP.NET Web Form, add the following:

<configuration>

<!-- Add the following configuration-->  
<location path="Admin">
 <system.web>
  <authorization>
    <deny users="?" />
  </authorization>
 </system.web>
</location>

</configuration>

The above configuration will force the users to login Azure Active Directory in order to access the relative location path of 'Admin' in your web application (eg http://localhost:8080/Admin ).