How to do Active Directory authentication in Razor (cshtml)

Question

I am doing a simple website with Razor. Currently, I have database-based authentication that works, as follows: In _AppStart.chtml: ``` WebSecurity.InitializeDatabaseConnection("db_connection", "users", "id", "username", true); ``` In login.cshtml page: ``` username = Request["username"]; password = Request["password"]; if (WebSecurity.Login(username, password, true)) { Response.Redirect("/admin"); } else { errorMessage = "Login was not successful."; } ``` In protected CSHTML pages, I have the following at the top of a page: ``` if (!WebSecurity.IsAuthenticated) { Response.Redirect("/login.cshtml"); } ``` Everything is pretty simple and works well. Now I would like to add authentication with AD. I don't know how to do it. I came from the Java world with many years of experience. For this simple website, I do not need MVC architecture. I need simple things similar to the above (if possible). I need to do authentication just within the login.cshtml file. I googled a lot and am unable to…

Accepted Answer

Since this is an internal application, and you're looking for something simple, I would consider writing a single class to do the Active Directory authentication. You're going to need a couple things though, in order for this to work :

- A reference to `System.DirectoryServices.Protocols` in your project.

- The IP or DNS name of your Active Directory server. We'll call it `host` in the code below.

- The port it's running on (LDAPS will be port 636, basic LDAP will be port 389). We'll call it `port` in the code below.

- The Domain to which your users belong. We'll call it `domain` in the code below.

Now that you have that, you can wire this up to check the credentials from the request against your AD instance. I would try something like this :

```
// the username and password to authenticate
username = Request["username"];
password = Request["password"];

// define your connection
LdapConnection ldapConnection = new LdapConnection("host:port");

try
{
      // authenticate the username and password
      using (ldapConnection)
      {
          // pass in the network creds, and the domain.
          var networkCredential = new NetworkCredential(username, password, domain);

// if we're using unsecured port 389, set to false. If using port 636, set this to true.
          ldapConnection.SessionOptions.SecureSocketLayer = false;

// since this is an internal application, just accept the certificate either way
          ldapConnection.SessionOptions.VerifyServerCertificate += delegate { return true; };

// to force NTLM\Kerberos use AuthType.Negotiate, for non-TLS and unsecured, just use AuthType.Basic
          ldapConnection.AuthType = AuthType.Basic;

// authenticate the user
          ldapConnection.Bind(networkCredential);
      }
      catch (LdapException ldapException)
      {
          //Authentication failed, exception will dictate why
      }
}
```

Also, in the same way you'd communicate an authorization issue before, the `ldapException` can tell you why the call failed. If you want to display custom messaging, I would check the `LdapException.ErrorCode` property, and maybe create a case statement of return messages based on the error codes.

Or, you could just output `LdapException.Message` directly to the page - either way, that will at least dictate to the user why their login didn't work.

How to do Active Directory authentication in Razor (cshtml)

Solution

Problem