用于应用程序角色映射的 Active Directory 集成

Question

I'm building a REST API (.NET Core with Entity Framework) and Angular frontend. What I want to achieve in terms of security is some sort of AD integration. I'd like to grant application permissions to AD groups and users. There will be an admin user mapping those users/groups to roles. What is the best way to do that? Should I make a microservice that queries AD every minute and refreshes all groups and users in the app? Or maybe a live connection to AD everytime admin user wants to grant/revoke someone's permission? I think the second way might not work, because everytime user logs in I'd need to query AD to see his/hers AD groups and check if the user has access.

So what I came up with so far is JWT token authentication and a microservice that will import all users/groups and mappings between them, so all authentication takes place inside the app/app's database, instead of constantly querying AD (which is pretty slow from what I remember).

Can you give me some ideas for improvement? Maybe I'm missing some solutions? Is JWT token the best way to go here?

Answer 1

Maybe this code Helps you. Beware that Parameter.GetStringValue is a personnal custom method, replace it with whatever you want.

using System;
using System.Text;
using System.DirectoryServices;

    public class Ldap
    {
        private string _path;
        private string _filterAttribute;

        /// <summary>
        /// prepares LDAP path to use in this class. Something like LDAP://myLANdomain.local
        /// </summary>
        /// <param name="path">If empty will get the value on Parameter 'LANdomain'</param>
        public Ldap(string path = "")
        {
            if (String.IsNullOrEmpty(path))
            {
                string domain = Parameter.GetStringValue("LANdomain");
                if (String.IsNullOrEmpty(domain))
                    throw new Exception("Domain is not defined");

                path = "LDAP://" + domain; //Fully-qualified Domain Name
            }

            _path = path;
        }

        //Error Error 0x80005000 go to IIS and recycle App Pool
        public bool IsAuthenticated(string username, string pwd, string domain ="")
        {

            if (String.IsNullOrEmpty(domain))
                domain = Parameter.GetStringValue("LANdomain");

            if (String.IsNullOrEmpty(domain))
                throw new Exception("Domain is not defined");

            string domainAndUsername = domain + @"\" + username;
            using (DirectoryEntry entry = new DirectoryEntry(_path, domainAndUsername, pwd))
            {
                try
                {
                    //Bind to the native AdsObject to force authentication.
                    object obj = entry.NativeObject;

                    using (DirectorySearcher search = new DirectorySearcher(entry))
                    {
                        //"(&(objectClass=user)(objectCategory=person)(|(SAMAccountName=*{0}*)(cn=*{0}*)(gn=*{0}*)(sn=*{0}*)(email=*{0}*)))"
                        search.Filter = "(&(objectCategory=person)(objectClass=user)(SAMAccountName=" + username + "))";
                        search.PropertiesToLoad.Add("cn");
                        SearchResult result = search.FindOne();

                        if (null == result)
                        {
                            return false;
                        }

                        //Update the new path to the user in the directory.
                        _path = result.Path;
                        _filterAttribute = (String)result.Properties["cn"][0];

                        return true;
                    }


                }
                //catch (DirectoryServicesCOMException cex)
                catch //(Exception ex)
                {
                    throw;
                    //throw new Exception("Error authenticating LDAP user. " + ex.Message);
                }


            }


        }



    }