Authentication with Active Directory by multiple clients

1
votes

A client that I work with have an existing Active Directory for their employee information, they want to create an application that can log in using information stored in Active Directory. The application should have a web (.NET), mobile (android and iphone), and optional desktop interface.

I haven't worked with Active Directory before. I did some study on Active Directory, and here's what I understand so far:

There are 2 ways to authenticate with an Active Directory:

  • By LDAP : for .NET, can use System.DirectoryServices (and
    System.DirectoryServices.AccountManagement) namespace classes to
    perform authentication. For android, iphone, I guess will have some
    libraries in those platform to do LDAP query to Active Directory (any suggestion?)
  • By ADFS as identity provider: from what I understand, ADFS is an extension to AD that provides SSO feature, and it can be configured as identity provider, is that correct? And so .NET, android, iphone clients can use their libraries to do oauth/openid authentication with Active Directory through ADFS

Is my understanding above correct? And which way is better? Why should one use one but not the other? How does Azure AD come into this picture?

1
c#android.netactive-directoryadfs

1 Answers

1
votes

Basically yes.

ADFS 3.0 supports OAuth2 - the earlier versions don't.

Note that there are a number of identity providers that can use AD e.g. shibboleth and PingFederate.

If you want SSO and if your .NET application is claims based (i.e. WIF) then use ADFS. You essentially outsource authentication to a trusted and verified security system and you get back a signed token that contains whatever AD attributes you require. ADFS also provides the ability to federate with other STS e.g. Azure AD.

In terms of mobile, have a look at Azure AD Authentication Library for .NET.

With AD you have to do this all yourself. It's up to you to get the AD attributes. And you need to think about how to ensure security.

With ADFS, you can synch your users to AAD and hence use your on-premise credentials in the cloud.