Apply Single-Sign-On to Your Application - Two Solutions (Page 4 of 5 ) Two Solutions
Therefore, the best for now would be a hybrid of both scenarios, taking the pros and cons of both. Have an application-architecture with a single user repository at the organization's LDAP Directory, but letting users sign on again for added security with the same user-credentials. This may solve the problem at hand. Still, the ideal can be achieved. Imagine your client email application asking you for your password each time its goes out to receive or send your emails. Microsoft .NET has made it easy to do both with just some switches of commands in a configuration file. Therefore, it doesn’t take much to deploy either solution depending on client needs. I will dive into some VB.NET Coding to explain how both can be achieved. Scenario A : True-Blue Single-Sign-On
 - At the launch of the application, query LDAP and see if the user is in the proper user-groups to access the application. I am, of course, assuming that groups are assigned to applications, and not individuals. [Note: ' / ' indicates that the syntax on the next line is part of the previous - Editor]
Private
Sub
Page_Load (ByVal sender As System.Object,
/ ByVal e As System.EventArgs)
Handles MyBase.Load
Dim p As
WindowsPrincipal = Thread.CurrentPrincipal
Dim a As New LDAPQuery
Dim
objCook As New HttpCookie("LDAPCookie")
'Check for authentication and write
into Cookie
Dim sLDAPCN As String = (a.GetCNByLDAP(p.Identity.Name))
'Check for LDAP Authentication First
If sLDAPCN <> "" And _
(a.blnFindCNinGroups(a.GetCNByLDAP(p.Identity.Name),
/ "AppAUserGroups"))
Then objCook.Value = (sLDAPCN) Response.Cookies.Add(objCook)
'Check for
LDAP User Existence in Application Database
'If User exists in Application
DB, Start Application
If (FindLDAPCNinDB(sLDAPCN))
Then 'DROP
Authentication Cookie token
'Compute a hashed value of the current session
ID
'into a cookie to signal authentication success
'Be sure to check for
this cookie for every page load
'if value doesnt match or cookie doesnt
exists,
'Re-do the whole authentication process again.
'Single-sign-on
should continue, the cookies drop
'prevent authenticated LDAP Users from not
having
'their CN mapped with other application-specific
'fields or data.
Response.Redirect("Welcome.aspx") Else
'If False, do Database mapping
Response.Redirect("CollectOtherInfo.aspx")
End If Else
Response.Redirect("LoginError.htm")
End If
End Sub
<LI>Private
Function FindLDAPCNinDB(ByVal sLDAPCN
/ As String) As
Boolean
'For ease of setup, I am using a Flat XML File as a database
'However, a proper way would be to use a relational database
'You may
use the ADO.NET to query and get
/ information from the databse
Dim
xmldoc As New XmlDocument
Dim xmlnode As XmlNode
Dim xmlnodelist As
XmlNodeList xmldoc.Load("D:WebDeployLDAPQueryFlatDB.xml")
xmlnodelist =
xmldoc.SelectNodes("/Users/User")
For Each xmlnode In xmlnodelist
'Find
LDAPCN
If xmlnode.ChildNodes.Item(0).InnerText = sLDAPCN
Then Return
True
End If
Next
Return False
End Function
'###########
'###########
Imports System.DirectoryServices
Public Class LDAPQuery
'This function returns the Common Name (CN)
'of the Login information of
the
'LDAP Directory. The CN is an unique identity
/ and cannot be
changed or edited in LDAP
Public
Function GetCNByLDAP(ByVal strLogin
/ As String) As String
Dim str As String = ""
'Parse the string to
check if domain name is present.
Dim idx As Integer = strLogin.IndexOf("")
If (idx = -1) Then idx = strLogin.IndexOf("@")
End If
Dim strDomain
As String
Dim strName As String
If (idx <> -1)
Then strDomain
= strLogin.Substring(0, idx)
strName = strLogin.Substring(idx + 1)
Else
strDomain = Environment.MachineName
strName = strLogin
End If
Dim
obDirEntry As DirectoryEntry = Nothing
Try
Dim strPath As String =
/
"<A href="ldap://DC=Softwaremaker,DC=net"> LDAP://DC=Softwaremaker,DC=net </A>"
obDirEntry = New DirectoryEntry(strPath)
Dim rootSearch As New /
DirectorySearcher(obDirEntry)
Dim SearchResult As SearchResult
Dim spn
As String = strName & "@"
& strDomain rootSearch.Filter =
("(&(objectCategory=user)
/ (userPrincipalName=" & spn & "))")
For Each SearchResult In rootSearch.FindAll /
'Or FindOne
Dim i As
Integer
'Check here - Should only return ONE result
For i = 0 To
SearchResult.Properties("cn").Count - 1 str += SearchResult.Properties("cn")(i)
Next
Next Catch ex As Exception str = ex.Message
End Try
Return
str
End Function
'Function finds and returns if User if in the specified
user group
Public Function blnFindCNinGroups(ByVal sLogonUserCN
/ As
String, ByVal sGroup As String) As Boolean
Try
Dim sDirEnt As String =
"<A href="ldap://server/CN">LDAP://server/CN</A>= " &
/
sLogonUserCN&",CN=Users,DC=Softwaremaker,DC=net"
Dim user As
DirectoryEntry = New DirectoryEntry(sDirEnt)
Dim pcoll As PropertyCollection
= user.Properties
Dim i As Integer Dim s As String
'The loop will return
all Groups of which the CN is a member Of
For i = 0 To
pcoll("memberOf").Count - 1 s = pcoll("memberOf")(i).ToString
If
QueryLDAP(s, sGroup) = True
Then Return True
Next Return False
Catch
ex As Exception
Return False
End Try
End Function
Public
Function
QueryLDAP(ByVal strQuery As String, / ByVal sGroup As String)
As Boolean Dim obDirEntry As DirectoryEntry = Nothing
Try
Dim
strPath As String = "LDAP://" & strQuery
Dim s As String obDirEntry =
New DirectoryEntry(strPath)
Dim rootSearch As New
DirectorySearcher(obDirEntry)
Dim SearchResult As SearchResult
For Each
SearchResult In rootSearch.FindAll
Dim i As Integer 'Check here - Should
only return ONE result
For i = 0 To SearchResult.Properties("cn").Count - 1
s += SearchResult.Properties("cn")(i)
Next
If s = sGroup
Then Return
True
Next Catch ex As Exception Return False
End Try
End Function
End Class
'###########
- I am by no means an LDAP Query guru or expert. I am sure I am taking one step too many just to query whether the user exists within the specified user group in the LDAP Directory. However, I am selling the idea, not the code. Hopefully you get the idea.
- Several things that can be applied include:
- Using Windows Authentication in the IIS Settings
- At the web.config file level...
'###########
<IDENTITY
impersonate="true" />
<AUTHENTICATION mode="Windows" /><AUTHORIZATION>
<ALLOW
roles="SoftwaremakerNetAppAUserGroup" />
</AUTHORIZATION>
'###########
Scenario B : Hybrid Forms Authentication with LDAP
 (*Please see http://support.microsoft.com/default.aspx?scid=kb;EN-US;326340 for a detailed working version.) Next: Conclusion >>
More ASP Articles
More By Softwaremaker |
/ 89 
