Active Directory and User Management

Question

I'm very new to LDAP and Active Directory and I'm probably understanding something completely wrong.

I know ASP.NET Identity and forms authentication (however, I'm also quite new to that) and my question is actually if it is possible to use certain features you can use with forms authentication (explanation further below) with Active Directory.

I'm building an MVC web application and I'd like to authenticate my users against Active Directory. That would be possible with ADFS. The template you get when using ASP.NET Identity in VS2013 uses passive authentication. Is it however possible to not do this redirect to the Active Directory domain but create a custom login page for the user?

Is it also possible to do user management with Active Directory like that is possible with forms authentication? I was thinking about:

• A page where the user can register himself
• Ability for the user to change his password (I know this is possible with ADFS, but the user may not be logged in. I want him to do this when he's logged in, with a self-made page.)
• Logging in on a new computer should ask for a code specified in an email
• Set up password policy in the application
• ... (Other things that I might have forgotten)

When these things aren't implicitly possible with Active Directory, please advise on how to configure the application to acquire this functionality (when possible with Active Directory).

Thank you very much in advance for helping me!

EDIT 1: To leave my question not too open, I maybe better just start with that custom login page. When I understand it well, the normal flow when using ADFS to authenticate your users against is:

1. A user tries to access a web page of an application for which he needs to be authenticated
2. (Passive) redirect to a login page provided by ADFS -> user enter his AD credentials
3. ADFS returns token
4. Token is sent to the web application (that ADFS trusts)
5. When the web application thinks everything is ok, it stores an authentication cookie in the user's browser (I guess), and the user can access the web page

What I would like:

1. A user tries to access a web page of an application for which he needs to be authenticated
2. Redirect to a login page of that same web application where the user can enter his credentials
3. The entered credentials are sent to ADFS (I guess) and it returns something (a token?) with information about whether the login succeeded or not (This step could be preceded by a call to some (self-made) service (a Web API application) that multiple client applications could use for their authentication against the same directory)
4. When the login succeeded, the web application stores a cookie in the user's browser and the user is able to access the page

I don't know if that makes sense? I'm just wondering how companies that use Active Directory to store user information can still have a custom login page, registration page and other user management stuff. (Or don't they use AD but do they just have their own databases?)

Answer 1

Normally if you want a custom login page you use an ADFS active profile implementation (e.g. WCF) to do the authentication.

User provisioning is not part of ADFS. To do this you need an Identity Manager e.g. PingFederate, OpenIDM.

If you are using ADFS 2.0 or 2.1, you can customize the pages (because they run on IIS) and add these features or redirect to a separate website which does.

Most of what you want is OOTB AD functionality. Refer: Everything in Active Directory via C#.NET 3.5 (Using System.DirectoryServices.AccountManagement).

Password policy can be extremely complex. I don't know of any API's that explicitly do this.

If you are using ADFS 3.0, these is no ISS so you are pretty much out of luck.

Answer 2

It's not really an answer to my question here, but if someone is interested in what I eventually did: you can read it (very briefly) here.