Question

I am using Windows authentication on a website but want to have levels of access. Currently, I am using the [Authorize(Users = “userA”)] syntax.

However, with upwards of twenty Windows accounts accessing a site, I don’t want to have to hard-code in twenty users with each Authorize statement. What’s more, some of the users need to have different access than others. I thought of having a list of users that a CustomAuthorizationAttribute iterates through to see if the desired user is among them.

Basically, I’m trying to get roles without using Forms authentication.

What is the most effective, most simple way of doing this?

Answer 1

Your answer lies within the ActiveDirectory domain. Since you are using MVC 3 you should have access to the following namespace “Directory Services Account Management”:

http://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.aspx

You can see this article for describing the whole process underneath, it provides sample code for you to use immediately out of the box:

http://msdn.microsoft.com/en-us/magazine/cc135979.aspx

Forwarning:
You will also have to establish an LDAP connection string. LDAP is a protocol used for retrieving that information from the secured windows database.

http://technet.microsoft.com/en-us/library/aa996205(v=exchg.65).aspx

To see the code being used in action:

http://www.willasrari.com/blog/query-active-directory-users-using-c/000133.aspx

I’ve done something similar to this in a .NET 3.5 environment using IIS 7.