Question

I was demonstrating my WPF application to a customer and he asked me if I have LDAP or can integrated with Active Directory (AD).

My application has its own in-build user security and data access security. I use my security framework to authenticate and give rights on screen and data access. The client asked me if I could add or integrate with active directory. He need the user to just remember his Windows password and not of my application.

I could implement Active Directory logic but then I have to modify my application to associate an Active Directory user with my application’s users so when the AD user logs in then he is authenticated and associated as my local user since the local user need to be associated with his security and data access settings. Is this the way to go?

I will be using .NET 3.5 classes for this etc. This would mean the administrator of my application should go to the user screen and associate the local user with the LDAP user also.?

Answer 1

No, I don’t think what you are proposing sounds like the right thing to do.

Rather, you should base security on a pluggable architecture (e.g. IPrincipal), and then have some way your application can be configured to use either your own security framework or simply WindowsPrincipal (that derives from IPrincipal):

You could, for example, have a configuration setting that specifies which security provider to use. If configured to use your own system, it’s going to ask the user for credentials and populate Thread.CurrentPrincipal with an instance that is based on your system.

If configured to use AD, it’s just silently going to set Thread.CurrentPrincipal to WindowsIdentity.GetCurrent() (wrapped in a WindowsPrincipal).

Take a look at how ASP.NET or WCF deals with security – that’s basically what they do.