具有自定义角色和Active Directory的ASP MVC 5 Windows身份验证

Question

I have an MVC 5 application set up with windows authentication and my own custom roles table for authorization. This works fine if the user exists in my application database - username in my users table maps to the usernames in active directory.

My question is how do I keep my users table in sync with active directory. Any time a new user is hired, a new record has to be added to my intranet application to ensure this user has access to it.

Is there a way to load users from active directory into my own users table perhaps with some kind of scheduled job or is there a better way to achieve what I'm trying to do?

Answer 1

I think sync two database instances (AD database and you app database) will become management issue as your business grow. Even, adding new user and removing is day to day work, so in both cases you need to execute some sort of action to add or remove users from your app database.

Why don't you ask your team to give you access of AD database and consume this into your intranet app, this is what I was using in my past organization and this works great.

Answer 2

The AD can be used in a programmatic manner. Just look for LDAP stuff and you'll find lots of examples. Here's one to get you started : Connect to Active Directory via LDAP

If your application allows people to register then implement your own custom membership provider which talks to the AD. You can create the users in the AD, you will have to pass the password requirements which are set on the AD as well, which is more than likely a good thing. The roles information can be stored there as well, no need for a local custom roles table either.