Can you use Windows Azure Active Directory with third party Active Directories?

0
votes

I am currently setting up an ASP.NET MVC application that will be hosted on the Windows Azure platform. The application may be used by hundreds of third parties, each with their own group of individual users, which will need to be authenticated by logging in. I am looking at using Windows Azure Active Directory (WAAD) for the authentication piece.

Obviously I can use WAAD to set up individual logins for each user, then add them to a group which has been set up for the third party they belong to.

This will likely be sufficient for most third parties. However, some may already have their own Active Directory (AD), which may or may not be a WAAD, with all of their users as members. I am wondering if there is a way that I can, relatively easily, provide a way for them to connect their Active Directory to my WAAD, allowing their directory users to authenticate with our WAAD.

I have read about integrating an on-premises AD with WAAD, either through synchronisation or using a federated login. However, all of the articles seem to be aimed at "your" on-premises AD linked with "your" WAAD. Obviously since you manage both directories there is inherent trust there. However, for obvious reasons, I only trust third parties to authenticate their users and do not want to open up a mechanism where they may be able to manage my WAAD and affect other people's users or groups.

So...

  1. Can I connect a third party AD with my WAAD and let them authenticate their users for my application, without compromising the security of my WAAD?
  2. If so, what is the best way to configure this set-up? Would I use the standard federated services software, for example, or is there something more suitable?
2
asp.net-mvcazureauthenticationactive-directoryazure-active-directory
Were you asking about WAAD (third party) to WAAD or AD (third party) to WAAD? – Brent Schmaltz
The third party may or may not be hosting the Active Directory on Azure, so my question was more about the third party having any type of AD and being able to use it with my WAAD. I will add this clarification to my question. – lmjwheeler

2 Answers

1
votes

1) You can definitely expose Azure AD applications to users from other Azure AD tenants, without the need to manage their directories or give them any access to yours. The Azure AD documentation refers to those kind of app as "multi-tenant". You can find a detailed example in https://azure.microsoft.com/en-us/documentation/samples/active-directory-dotnet-webapp-multitenant-openidconnect/. 2) multi-tenant applications operate under the assumption that all the participating directories have their corresponding Azure ADS tenant. That is the case when, for example, they did set up Office365 or any other cloud service. Direct federation would not work in this scenario, given that the just in time provisioning of apps and the enforcement of permission and access rules relies on the directories and users being stored in shared infrastructure (though still completely isolated form each other, as is always the case in sound multitenant systems). Please try the sample, hopefully it will help making the above more concrete. HTH