ASP.NET MVC - Authenticate users against Active Directory, but require username and password to be inputted

Question

I'm developing a MVC3 application that will require a user to be authenticated against an AD. I know that there is the option in MVC3 to create an Intranet Application that automatically authenticates a user against an AD, but it uses Windows Authentication and automatically logs them on. This application may be accessed on 'Open' workstations where the user will need to enter their Domain Username and Password. Any examples or online tutorial would be great. An example project would be exceptional.

Solution 1

You can use the standard Internet application template with forms authentication and insert an ActiveDirectoryMembershipProvider into the web.config:

<connectionStrings>
    <add name="ADConnectionString" connectionString="LDAP://YOUR_AD_CONN_STRING" />
</connectionStrings>

<system.web>
    <authentication mode="Forms">
        <forms name=".ADAuthCookie" loginUrl="~/Account/LogOn"
               timeout="15" slidingExpiration="false" protection="All" />
    </authentication>
    <membership defaultProvider="MY_ADMembershipProvider">
        <providers>
            <clear />
            <add name="MY_ADMembershipProvider" 
                 type="System.Web.Security.ActiveDirectoryMembershipProvider" 
                 connectionStringName="ADConnectionString"
                 attributeMapUsername="sAMAccountName" />
        </providers>
    </membership>
</system.web>

In this way you get the Internet application template login form, and it validates against AD for you.

Then it's just a matter of some AccountController cleanup to remove reset password/change password/register functionality leaving just Login.

Solution 2

As mentioned above, you can use the membership provider defined in the web.config file.

The code below is within the implementation of the 'AccountController' from the MVC 3 Template code and has been slightly modified to work with ActiveDirectory:

 [HttpPost]
    public ActionResult LogOn( LogOnModel model, string returnUrl )
    {
      if( ModelState.IsValid )
      {
        // Note: ValidateUser() performs the auth check against ActiveDirectory
        // but make sure to not include the Domain Name in the User Name
        // and make sure you don't have the option set to use Email Usernames.
        if( MembershipService.ValidateUser( model.UserName, model.Password ) )
        {
            // Replace next line with logic to create FormsAuthenticationTicket
            // to encrypt and return in an Http Auth Cookie or Session Cookie
            // depending on the 'Remember Me' option.
            //FormsService.SignIn( model.UserName, model.RememberMe );

            // Fix this to also check for other combinations/possibilities
            if (!String.IsNullOrEmpty(returnUrl))
            {
                return Redirect(returnUrl);
            }
            else
            {
                return RedirectToAction("Index", "Home");
            }
        }
        else
        {
            ModelState.AddModelError("", "The user name or password provided is incorrect.");
        }
    }

If using .NET 3.5 -- then read this article for the alternative:

Comments

[roeland]

I think it should be Membership.ValidateUser instead of MembershipService.ValidateUser

[Brendan Vogt]

cpoDesign is probably using his own service to validate a user, namely MembershipService. Inside it he probably uses MembershipService.ValidateUser.

[James Harpe]

How can we do this for MVC4?

[Afshar Mohebi]

And how it can be used with ASP.NET Core (MVC 6)?

[PatsonLeaner]

@Khepri, How can I implement the following in MVC5?