Use synced Active Directory in Azure to validate users including groups?

Question

I am porting an application to azure and in that app we use Active Directory to authenticate users like the following:

var user = model.UserName.Split('\\');
using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, user[0]))
{
    if (pc.ValidateCredentials(user[1], model.Password, ContextOptions.Negotiate))
    {
        using (var adUser = UserPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, user[1]))
        {
            if (!MembershipService.ValidateUser(model.UserName, model.Password))
            {
                using (var userDb = new UsersDbContext())
                {
                    if (userDb.aspnet_Users.Count(u => u.UserName.ToLower().Contains(model.UserName)) <= 0)
                        MembershipService.CreateUser(model.UserName, model.Password, adUser.EmailAddress);
                    else
                    {
                        var msUser = Membership.GetUser(model.UserName);
                        msUser.ChangePassword(msUser.ResetPassword(), model.Password);
                    }
                }
            }
            FormsService.SignIn(model.UserName, model.RememberMe);

            foreach (var role in Roles.GetAllRoles())
            {
                using (var group = GroupPrincipal.FindByIdentity(pc, role))
                {
                    if (group != null)
                    {
                        if (adUser.IsMemberOf(group))
                        {
                            if (!Roles.IsUserInRole(model.UserName, role))
                                Roles.AddUserToRole(model.UserName, role);
                        }
                        else
                        {
                            if (Roles.IsUserInRole(model.UserName, role))
                                Roles.RemoveUserFromRole(model.UserName, role);
                        }
                    }
                }
            }
        }
    }
}

This works fine on our web-server which is connected to our domain server.
Now I set up an Windows Azure Active Directory and configured it to be synced with our On-Premise AD which also works.

But I am now struggeling on finding a way to connect my PrincipalContext to the WAAD.

Is this even possible and how? If not, what is the alternative?

I only found examples using Single-Sign-On which does this redirection to the MS login page we do NOT want to use, because we have a mixed authentication and depending on the entered user name it either uses the ASP.NET Membership or pulls the user and groups from AD (and actually creates an ASP.NET Membership user as seen above).

I think you might need to use WAAD Graph API msdn.microsoft.com/en-us/library/windowsazure/hh974476.aspx for your custom authentication implementation. — ramiramilu

astaykov astaykov · Accepted Answer · 2014-01-12T16:00:21

No.

You can't really use PrincipalContext with WAAD. Have to explicitly state here that you cannot currently (Jan. 2014) do direct user authentication against WAAD. You will need to rewrite some parts of your application to be compatible:

Authentication happens only on the WAAD side, your code cannot do user+password validation. This also happens on WAAD provided login page. You have limited control on how this page looks like and can customize it via Premium features of WAAD.
You can create users and reset user password using the WAAD Graph API.
Explore the Graph API for additional operations you might need (i.e. ask for user's group membership, direct reports, etc.)
You will have to switch from Windows Authentication to Federated Authentication. Depending on what VS version you are using this might be easy or tough. For VS 2012 there is Identity and Access Tool extension. While in 2013 authentication can only be configured when you create the project and cannot be altered afterwards. But you can copy configuration changes from other project over. You need changes in web.config file along with what is initialized in global.asax. Check it here - although about VS 2013 RC, the process is same in RTM.

Use synced Active Directory in Azure to validate users including groups?

1 Answers