Active Directory Authentication

Question

I am have made one web application in asp.net.In my project Authentication was done by matching the username and password in database.But now client ask me for the auto login in application with the help Of Active Directory authentication. Client ask suggest me to use the Email Id of user in AD for the authentication.

I tried to fetch the records in the AD, I could fetch the Fullname of user but I couldn't get the Email id,

I tried the code:

 System.Security.Principal.WindowsIdentity wi = System.Security.Principal.WindowsIdentity.GetCurrent();
  string[] a = Context.User.Identity.Name.Split('\\');

  System.DirectoryServices.DirectoryEntry ADEntry = new System.DirectoryServices.DirectoryEntry("WinNT://" + a[0] + "/" + a[1]);
  string Name = ADEntry.Properties["FullName"].Value.ToString();

Further more I Use DirectorySearcher but it genterates Error that Coulnot search the record in the client server..

Answer 1

I had the exact same situation while making a portal for a company. If they dont want you to get into their AD then what you can do is to request for the NTLogins of the people who will be given access to the portal. make a simple table which have their NTLogin and simply authenticate using the system from which the portal is being accessed. Check out the sample code i used.

// Checking if the user opening this page is listed in the allowed user list against their NT login.
        String sUser = Request.ServerVariables["LOGON_USER"].ToLower();
        sUser = sUser.Replace("wt\\", "");

        //Authentication using a custom auth method.
        DatabaseOperations authenticateUser = new DatabaseOperations();
        if (!authenticateUser.authenticate(sUser))
        {
            //unauthorized users will be redirected to access denied page.
            Server.Transfer("AccessDenied.aspx", true);
        }

And making sure that you have authentication mode to windows in your web.config file

<authentication mode="Windows"></authentication>

Hope this helps.

Answer 2

For reading AD data, i use this class. It is setup for our AD, but basically you can just pass in all the "fields" you want to find, in the params. But you need to know what field holds the email address. Sysinternals made a pretty good tool for browsing AD, to figure out what you are looking for, called ADExplorer.

But I don't understand why you need to look in the AD? Can you not assume that the user is already authenticated, if they are on the network, and then rely on the windows identity?

    public static Hashtable GetAttributes(string initials, params string[] Attribute)
{
    DirectoryEntry directoryEntry = new DirectoryEntry("LDAP://ADNAME");
    DirectorySearcher ADSearcher = new DirectorySearcher(directoryEntry);
    ADSearcher.Filter = "(sAMAccountName=" + initials + ")";
    foreach (string para in Attribute)
    {
        ADSearcher.PropertiesToLoad.Add(para);
    }
    SearchResult adSearchResult = ADSearcher.FindOne();

    Hashtable hshReturns = new Hashtable();
    foreach (string para in Attribute)
    {
        string strReturn = "";
        if (adSearchResult.Properties[para].Count == 0)
            strReturn = "";
        else
            strReturn = ((ResultPropertyValueCollection)adSearchResult.Properties[para])[0].ToString();
        hshReturns.Add(para, strReturn);
    }
    return hshReturns;
}