ASP.NET Forms Based Authentication with Active Directory

If you've ever used Visual Studio's 2010 the default template for an ASP.NET Web Site is a really nice. It allows you to give users accounts based on SQL accounts it creates. I however wanted to use Active  Directory instead of SQL and do the user authentication there instead of setting it on the entire IIS site. This also allows you to have a much prettier login page rather than the normal web browser's "basic access authentication" prompt.

I figured that changing the ASP 4.0 WebSite to use Active Directory would be be a GUI wizard to do it but found a large amount of confusion on the subject when I was researching how. After Figuring it out for myself I figured I'd write a guide on how.

Setup your machine
Serveral of the problems I observed were people had problems with their website and Visual Studio install before they even started with change the website to use AD. Start by creating a WebSite from the "ASP.NET Web Site" using .Net Framework 4. Don't make a single change and build and run the project. Does the site come up. Can you register a user account and then login to that user account. If not don't proceed any further till you can.

The cause for this for many people was that the website went to use the SQLEXPRESS instance only to find that it wasn't installed or running. As a result you'll get the following error from IIS.

A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: SQL Network Interfaces, error: 26 - Error Locating Server/Instance Specified)

Changing the Template to use Active Directory
Nearly everything nessory is done in the web sites root web.config file. Below is a copy of the complete file.

• Add connectionStrings "ADService" to domain your going to use. example "LDAP://nku.edu" (note i tried to alter this to use )
• Notice that we remove the AspNetSqlMembershipProvider and added AspNetActiveDirectoryMembershipProvider. 
• Making sure to set AspNetActiveDirectoryMembershipProvider as the default membership provider.
• Setting attributeMapUsername to sAMAccountName 

<?xml version="1.0"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>
 <connectionStrings>
  <add name="ADService" connectionString="LDAP://Domainname.com"/> 
  <add name="ApplicationServices" 
         connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnetdb.mdf;User Instance=true" 
         providerName="System.Data.SqlClient"/>
 </connectionStrings>
 <system.web>
  <compilation debug="true" targetFramework="4.0">
   <assemblies>
    <add assembly="stdole, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
      </assemblies>
    </compilation>
  <authentication mode="Forms">
   <forms loginUrl="~/Account/Login.aspx" timeout="2880"/>
  </authentication>
  <membership defaultProvider="AspNetActiveDirectoryMembershipProvider">
   <providers>
    <clear/>
    <!-- <add name="AspNetSqlMembershipProvider" 
             type="System.Web.Security.SqlMembershipProvider" 
             connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/"/> -->
    <add name="AspNetActiveDirectoryMembershipProvider"
             type="System.Web.Security.ActiveDirectoryMembershipProvider,  System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 
             connectionStringName="ADService" 
             attributeMapUsername="sAMAccountName"/>
   </providers>
  </membership>
  <profile>
   <providers>
    <clear/>
    <add name="AspNetSqlProfileProvider" 
             type="System.Web.Profile.SqlProfileProvider"
             connectionStringName="ApplicationServices"
             applicationName="/"/>
   </providers>
  </profile>
  <roleManager enabled="false">
   <providers>
    <clear/>
    <add name="AspNetSqlRoleProvider" 
             type="System.Web.Security.SqlRoleProvider" 
             connectionStringName="ApplicationServices"
             applicationName="/"/>
    <add name="AspNetWindowsTokenRoleProvider"
             type="System.Web.Security.WindowsTokenRoleProvider"
             applicationName="/"/>
   </providers>
  </roleManager>
 </system.web>
 <system.webServer>
  <modules runAllManagedModulesForAllRequests="true"/>
 </system.webServer>
</configuration>

We also want to create content where the user has to be authenticated to view. Create a new folder to the project. , i called mine "Content". Then add a new item to the folder, selecting "web config". Alter the new web.config to match below.

<configuration>
    <system.web>
      <authorization>
        <!-- deny = ? means deny unauthenticated users -->
        <deny users="?"/>
      </authorization>
    </system.web>
</configuration>

This means that any content inside this folder requires the users first be authenticated before they can access. Any link to this content will first prompt an unauthenticated user to login and then be redirected to the linked content.


Cleanup
There were a several pages and links we can remove as the aren't used since we are using AD to authenticate via forms based authentication. You could comment them out if you ever want to switch back to SQL based users.

• Remove the "Register User" hyperLink from Login.aspx and delete the Register.aspx file.
• Change the Site.Master using   we change the tabs users can see depending on if they are logged in or not.

Source
I've included a Visual Studio 2010 Project using Framework 4 that may be useful to view how it works and the changes I made.

Download  - Web Site Using AD Forms Based Authentication

Pictures showing the user Login

Anonymous User Viewing the Site

User accessing Login Page or Content that requires Login

Authenticated User Viewing Site

Links
http://stackoverflow.com/questions/895002/asp-net-active-directory-membership-provider-and-sql-profile-provider/5779884#5779884
http://www.howtodothings.com/computers/a792-aspnet-forms-authentication-with-roles.html
http://msdn.microsoft.com/en-us/library/ff648341.aspx#paght000012_step1

Enable LDAP over SSL (LDAPS) on Windows 2008 Active Directory Domain

Today I did some work on getting our Dell Remote Access Cards (DRAC) to use Active Directory for authentication. The cards only supported LDAPS so after looking into it I realized my Domain Controller's didn't do LDAP over SSL (LDAPS).

So after some work on it here’s the solution to enable it. I found a few posts on line but they didn't seem to be written very clear for a environment with a Certificate Authority(CA) not on a Domain Controller (DC).

I found that all you really have to do is give the DC the correct type of certificate and it will automatically do LDAP over SSL. An important requirement here is that I didn’t want to force connections to use LDAP over SSL but rather just enable it to work if something wants to use it.

Environment
Microsoft Active Directory: Windows 2008
Certificate Authority: Windows 2008 Server that is not a Domain Controller

Solution


Enable The Domain Controller Authentication Certificate Template on the Certificate Authority
Starting with your Certificate Authority (CA) we need to make sure that the Domain Controllers (DC's) can enroll with the CA in order to obtain the correct Certificates. There is a Certificate Template for this that exists by default. To configure this Logon to the CA and open Server Manager and then expand the roles till you get the view below.

• Expand the tree till you see the Certificate Templates folder and look for the Domain Controller Authentication the default existing template.
• Then expand the CA server and check if its listed under its Certificate Templates folder as well. If the Domain Controller Authentication is listed in both places then it exists and is enabled. If it isn't under the CA's Folder then we need to enable the Domain Controller Authentication Certificate Template.
•  Right click Certificate Templates under the CA, Click New, then and Click Certificate Template to Issue. Select the Domain Controller Authentication and then click OK.