在MVC中检索用户数据的Active Directory身份验证

Question

In my MVC5 application, I used to apply the following approach by just checking if the user is exist or not in Active Directory . Now, I want to use another approach like that: I send the username and password to the active directory and if the user exists in it, it should return some active directory info ie user's Name , Surname , Department . So, how can I define such a kind of authentication in Controller and web.config ?

web.config :

<configuration>
  <system.web>
    <httpCookies httpOnlyCookies="true" />
    <authentication mode="Forms">
      <forms name=".ADAuthCookie" loginUrl="~/Account/Login" timeout="45" slidingExpiration="false" protection="All" />
    </authentication>
    <membership defaultProvider="ADMembershipProvider">
      <providers>
        <clear />
        <add name="ADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName" connectionUsername="myadmin@company" connectionPassword="MyPassword" />
      </providers>
    </membership>
  </system.web>
  <connectionStrings>
    <!-- for LDAP -->
    <add name="ADConnectionString" connectionString="LDAP://adadfaf.my.company:111/DC=my,DC=company" />
  </connectionStrings>
</configuration>

Controller:

[AllowAnonymous]
[ValidateAntiForgeryToken]
[HttpPost]
public ActionResult Login(User model, string returnUrl)
{
    if (!this.ModelState.IsValid)
    {
        return this.View(model);
    }       

    //At here I need to retrieve some user data from Active Directory instead of hust a boolean result
    if (Membership.ValidateUser(model.UserName, model.Password))
    {
        //On the other hand I am not sure if this cookie lines are enough or not. Should I add some additional lines?
        FormsAuthentication.SetAuthCookie(model.UserName, false); 
        if (this.Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
            && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
        {
            return this.Redirect(returnUrl);
        }
        return this.RedirectToAction("Index", "Issue");
    }

    TempData["message"] = "The user name or password provided is incorrect.";
    return this.View(model);
}

Answer 1

What I did was to create a Class "Session User" which where holding the UserID, LoginName and were able to Validate the User Credentials.

In this Class you also got to put/call the Methods/Properties to get department, Surname and more...

public class SesssionUser
{
    [Key]
    [Required]
    public int UserId { get; set; }
    [Required]
    public string LoginName { get; set; }
    [Required]
    [DataType(DataType.Password)]
    public string Password { get; set; }


    private Boolean IsAuth{ get; set; }
    public string Department
    { 
        get { 
        return GetDepartment();
        }
    }

    private string GetDepartment()
    {
        if(!IsAuth) { return null; }
        //Gets the department.
    }

    private bool Authenticate(string userName,string password, string domain)
    {
        bool authentic = false;
        try
        {
            DirectoryEntry entry = new DirectoryEntry("LDAP://" + domain,
            userName, password);
            object nativeObject = entry.NativeObject;
            authentic = true;
        }
            catch (DirectoryServicesCOMException) { }
            return authentic;
     }

    /// <summary>
    /// Validates the user in the AD
    /// </summary>
    /// <returns>true if the credentials are correct else false</returns>
    public Boolean ValidateUser()
    {
        IsAuth = Authenticate(LoginName,Password,"<YourDomain>");
        return IsAuth;
    }
}

The next step was to create a Controller, in my case "AccountController" which handels the Login and Logout of an user. It uses FormsAuthentication to set auth. cookies.

using System;
using System.Globalization;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using System.Web;
using System.Web.Mvc;
using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Microsoft.Owin.Security;
using System.Web.Security;

using MVCErrorLog.Models;

//My class
using Admin.ActiveDirectoryHelper.Objects;

using MVCErrorLog.ViewModels;

namespace MVCErrorLog.Controllers
{

    public class AccountController : Controller
    {
        public ActionResult Login()
        {
            return View();
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public ActionResult Login(string username, string pw)
        {
            if (!ModelState.IsValid) { return RedirectToAction("Index", "Home"); }

            var sessionUser = new SesssionUser();
            sessionUser.LoginName = username;
            sessionUser.Password = pw;
            sessionUser.UserId = 1;

            if (!sessionUser.ValidateUser()) { return View("Login"); }
            FormsAuthentication.SetAuthCookie(sessionUser.LoginName, true);
            return RedirectToAction("Index", "ErrorLogs");
        }

        public ActionResult LogOff()
        {
            FormsAuthentication.SignOut();

            return RedirectToAction("Index", "ErrorLogs");
        }


        private SesssionUser SetupFormsAuthTicket(SesssionUser user, bool persistanceFlag)
        {
            var userData = user.UserId.ToString(CultureInfo.InvariantCulture);
            var authTicket = new FormsAuthenticationTicket(1, //version
                                user.LoginName, // user name
                                DateTime.Now,             //creation
                                DateTime.Now.AddMinutes(30), //Expiration
                                persistanceFlag, //Persistent
                                userData);

            var encTicket = FormsAuthentication.Encrypt(authTicket);
            Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
            return user;
        }


        protected override void Dispose(bool disposing)
        {
            if (disposing)
            {

            }

            base.Dispose(disposing);
        }
    }
}

The Last step is to configure the conf. file to use the auth. mode Forms

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="1440" /> <!--1440min = 24hours-->
</authentication>

Now you just have to call Login in the view and pass the parameters and you are good.