🔒 Locked

Active Directory: Validate user login?!

Started by Samurai Jack Feb 20, 2007 at 1:44 AM 0 replies 800+ views

Original Post

Feb 20, 2007 at 1:44 AM

Greetings! I was wondering how is it possible to use active directory user to login into a smaller application. Let us say on a local machine there are 10 users in a special group called "My Application" all users may logon to machine to their own desktop. Of course they have to use passwords. So far so good. I am able to list the active directory and set a filter like: show all users in group "My Application". Works fine. The problem is, when I start my application, I may ask for user name and compare it against the list. For example I you were John Lenon, you might have an username johnl and I could track it on the list. If it is not on the list, you shall not log in. OK. So we have the username, but how to compare the password? I think, it is not possible to say userObject.GetPassword or userObject.Properties["password"] and get a human readable string, instead I believe i have to encode my password string to something encrypted and then compare the encrpyted strings? Or am I wrong? Currently I'm doing everything in C# usind DirectoryEntry.

Bregma

Feb 20, 2007 at 7:54 AM

You will need to import the name into the GSSAPI (or Microsoft's equivalent, the acronym for which I forget at the moment but the workings of which are the same), create a a security context, and establish an authentication session.

AD uses Kerberos for authentication and leverages LDAP for authorization. It's not some simple mindless skripter-friendly compare-the-hash password scheme, it's an industrial-strenth, robust, secure, and complicated mechanism.

Really, it's not so hard to use from a programmatic API, but set up and administration is the sort of thing you hire a team of MSCEs for. Perhaps you need something a little less?

--smw

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.