使用SQL Server中的配置文件对Active Directory进行ASP.NET MVC和WCF身份验证/授权

Question

I have an intranet application, which can also be accessed from internet by clients. What I need to do is provide users that access it from the internet a login form to enter credentials and validate them against AD. Users that access this app from intranet should be logged in automatically.

As I know I can't mix two authentication types in ASP.NET projects. So I need to use FormsAuthentication with ActiveDirectoryMembershipProvider to authenticate users. But what about profiles? I need to select profiles based on user's group (ie if it's a manager load profile from managers table, if it's a customer - from customer table).

The second problem is that I need to use authenticated persons credentials to access WCF services. And determine what they can/can't do based on their group membership.

Is using FormsAuthentication correct way to do this or I need to look somewhere else?

I use EF code-first approach to create database. Services are implemented as WCF services. The app itself is an ASP.NET MVC site. But in far far future I will need WP7 client.

Answer 1

We had a set of similar requirements and the way that we approached it was to implement the authentication and profile management ourselves and, once a user was authenticated, using FormsAuthentication for site security.

For scenarios where the user name and password are provided (login form, wcf client), you can call the LogonUser method. Once the user is authenticated, you can use their authenticated user name in FormsAuthentication.

The scenario where the user should automatically be signed on will be slightly more complicated because you will have to have anonymous authentication available on the main site in order to support manual logins.

The way that we resolved this was to add a separate web application as a subdirectory of the main application and configured this sub application to only support windows authentication. When this portal is hit by internal users, we pickup their AD login from Request.ServerVariables("logon_user"), encrypt it with a token that is good for 5 seconds, then Response.Redirect the user to the main application with the encrypted network login in the query string.

If the main application sees this parameter in the query string, it decrypts it, validates it is within the allowable timespan, then uses this credential to log the user on using FormsAuthentication (it may sound like a lot, but the description actually takes up more space than the code).

Hopefully this will give you some ideas.