current community

your communities

more stack exchange communities

Stack Exchange
tour help
careers 2.0
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 38 down vote favorite
35

I'm developing a MVC3 application that will require a user to be authenticated against an AD. I know that there is the option in MVC3 to create an Intranet Application that automatically authenticates a user against an AD, but it uses Windows Authentication and automatically logs them on. This application may be accessed on 'Open' workstations where the user will need to enter their Domain Username and Password. Any examples or online tutorial would be great. An example project would be exceptional.

share|improve this question

2 Answers 2

up vote 34 down vote accepted

You can use the standard Internet application template with forms authentication and insert an ActiveDirectoryMembershipProvider into the web.config:

<connectionStrings>
    <add name="ADConnectionString" connectionString="YOUR_AD_CONN_STRING" />
</connectionStrings>

<system.web>
    <authentication mode="Forms">
        <forms name=".ADAuthCookie" loginUrl="~/Account/LogOn" timeout="15" slidingExpiration="false" protection="All" />
    </authentication>
    <membership defaultProvider="MY_ADMembershipProvider">
        <providers>
            <clear />
            <add name="MY_ADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName" />
        </providers>
    </membership>
</system.web>

In this way you get the Internet application template login form, and it validates against AD for you.

Then it's just a matter of some AccountController cleanup to remove reset password/change password/register functionality leaving just Login.

share|improve this answer
    
How can we do this for MVC4? –  James Harpe Sep 24 '13 at 13:05
    
@JamesHarpe Its the same... –  Rovdjuret Feb 25 at 13:46
up vote 9 down vote

As mentioned above, you can use the membership provider defined in the web.config file.

The code below is within the implementation of the 'AccountController' from the MVC 3 Template code and has been slightly modified to work with ActiveDirectory:

 [HttpPost]
    public ActionResult LogOn( LogOnModel model, string returnUrl )
    {
      if( ModelState.IsValid )
      {
        // Note: ValidateUser() performs the auth check against ActiveDirectory
        // but make sure to not include the Domain Name in the User Name
        // and make sure you don't have the option set to use Email Usernames.
        if( MembershipService.ValidateUser( model.UserName, model.Password ) )
        {
            // Replace next line with logic to create FormsAuthenticationTicket
            // to encrypt and return in an Http Auth Cookie or Session Cookie
            // depending on the 'Remember Me' option.
            //FormsService.SignIn( model.UserName, model.RememberMe );

            // Fix this to also check for other combinations/possibilities
            if (!String.IsNullOrEmpty(returnUrl))
            {
                return Redirect(returnUrl);
            }
            else
            {
                return RedirectToAction("Index", "Home");
            }
        }
        else
        {
            ModelState.AddModelError("", "The user name or password provided is incorrect.");
        }
    }

If using .NET 3.5 -- then read this article for the alternative:

share|improve this answer
    
I think it should be Membership.ValidateUser instead of MembershipService.ValidateUser –  Roeland Nov 20 '12 at 10:39
    
cpoDesign is probably using his own service to validate a user, namely MembershipService. Inside it he probably uses MembershipService.ValidateUser. –  Brendan Vogt Mar 25 '13 at 12:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.