Authentication with Active Directory (AD) with Asp.Net

Overview:

Now a day’s many companies are adopting registration and authentication for their employees for In-House applications at active directory domain level. In-House applications can register only those users which are already working inside companies’ domain.

Here I am writing this blog which will let developer knows that how in house applications can manage below two processes:

1. Registration of users using Active directory domain
2. Authenticate users inside Active Directory domain

How to Register Users for In-House applications by using Active Directory:

1. Create a user registration page.
2. Provide search user name textbox which can search the user name inside Active directory domain.
3. We can provide pop up with list of AD users that matches with the username.
4. User can select any user from pop up and the registration form can automatically fill up the information using AD details.
5. Save the user details in database. We do not need to save the password for the user as we are doing AD authentication.
6. If the user is already registered than we can prompt a dialog indicating that the user is already registered.

We can search the user based on user name:

 

 

Pop up with Search results:

 

 

C# Code to fetch users from Active directory:

using System;

using System.DirectoryServices.AccountManagement;

using System.Security.Claims;

using Microsoft.Owin.Security;

using System.DirectoryServices;

using System.Collections.Generic;

namespace ADdemoProject

{

/// <summary>

/// Class AdAuthenticationService

/// </summary>

public class AdAuthenticationService

{

public List<UserMaster> GetUserFromAD(string name)

{

var domainContext = new PrincipalContext(ContextType.Domain);

var groupPrincipal = GroupPrincipal.FindByIdentity(domainContext, IdentityType.SamAccountName, “Domain Users”);

UserPrincipal user = new UserPrincipal(domainContext);

user.Enabled = true;

user.SamAccountName = name;

PrincipalSearcher pSearch = new PrincipalSearcher();

pSearch.QueryFilter = user;

PrincipalSearchResult<Principal> results = pSearch.FindAll();

List<UserMaster> lstUsers = new List<UserMaster>();

foreach (var item in results)

{

UserMaster objUser = new UserMaster();

objUser.UserName = item.SamAccountName;

objUser.FullName = item.DisplayName;

lstUsers.Add(objUser);

}

return lstUsers;

}

}

}

How can we authenticate users inside ?

1. Create a Login page with User Name and Password fields.
2. When user enters credentials then we need to check first in our application db that the user name exists or not.
3. If user does not exist then we do not need to authenticate in AD.
4. If user exists in application db then we need to authenticate the credentials in AD.
5. If authentication gets failed from AD then we need to log the wrong attempts made by user because the number of wrong attempts performed in application login page should not be more than actual machine attempts. If we will not log the number of wrong attempts then actual machine will gets locked and then we need to ask Admin to unlock machine.
6. Before reaching to maximum wrong attempts we need to set logic in application db so we can avoid machine lock issue. Once the user has performed maximum no. of wrong attempts then we will stop to perform authentication in AD which will avoid machine lock issue.

What is ASP.NET Web API and How it works?

Login with unregistered user in application:

 

 

Login with wrong credentials with maximum attempts:

 

 

C# code to Authenticate user credentials in AD:

using System;

using System.DirectoryServices.AccountManagement;

using System.Security.Claims;

using Microsoft.Owin.Security;

using System.DirectoryServices;

using System.Collections.Generic;

namespace ADdemoProject

{

/// <summary>

/// Class AdAuthenticationService

/// </summary>

public class AdAuthenticationService

{

public AuthenticationResult SignIn(String username, String password)

{

// authenticates against your Domain AD

ContextType authenticationType = ContextType.Domain;

 

PrincipalContext principalContext = new PrincipalContext(authenticationType);

bool isAuthenticated = false;

UserPrincipal userPrincipal = null;

 

try

{

isAuthenticated = principalContext.ValidateCredentials(username, password, ContextOptions.Negotiate);

if (isAuthenticated)

{

userPrincipal = UserPrincipal.FindByIdentity(principalContext, username);

}

}

catch (Exception)

{

isAuthenticated = false;

userPrincipal = null;

}

if (!isAuthenticated || userPrincipal == null)

{

return new AuthenticationResult(“Username or Password is not correct”);

}

if (userPrincipal.IsAccountLockedOut())

{

// here can be a security related discussion weather it is worth

// revealing this information

return new AuthenticationResult(“Your account is locked.”);

}

if (userPrincipal.Enabled.HasValue && userPrincipal.Enabled.Value == false)

{

// here can be a security related discussion weather it is worth

// revealing this information

return new AuthenticationResult(“Your account is disabled”);

}

var identity = CreateIdentity(userPrincipal);

authenticationManager.SignOut(MyAuthentication.ApplicationCookie);

authenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = false }, identity);

return new AuthenticationResult();

}

}

}

Conclusion

Active Directory remains the backbone of enterprise identity and access management, and understanding its core components is essential for IT professionals and businesses alike. From centralized user authentication to streamlined resource management, Active Directory Domain Services enables organizations to maintain a secure, scalable, and well-organized network infrastructure. As businesses continue to prioritize robust security and efficient IT administration, investing in an Active Directory certification can significantly boost your career prospects and technical expertise in this critical domain. Whether you’re managing a small business network or a large enterprise environment, mastering Active Directory concepts and staying updated with the latest domain services practices will help you build more secure, resilient, and future-ready IT systems.

FAQs

Q1. What is Active Directory Domain Services (AD DS)?
Active Directory Domain Services is a core Windows Server role that stores and manages information about users, computers, and other resources on a network, enabling centralized authentication and access control.

Q2. Is an Active Directory certification worth it for IT professionals?
Yes, an Active Directory certification validates your skills in managing network infrastructure, user permissions, and security, making you more competitive for system administrator and IT support roles.

Q3. What are the hardware requirements to set up an Active Directory server?
An Active Directory server typically requires a Windows Server OS, sufficient RAM and storage, a static IP address, and DNS configuration to function as a domain controller effectively.

Q4. Can Active Directory be used for both small and large businesses?
Yes, Active Directory Domain Services is scalable and can be configured for small networks with a few users or large enterprise environments with thousands of devices and accounts.

Author – Sahil Joshi