LDAP Access Control for ASP.Net

Follow the same steps as above to connect to the directory instance, but this time we will connect to your new naming context (cn=Sandbox,dc=ITOrg) instead of the Configuration naming context. Note that we are still connecting as the current user, i.e. via NTLM as a Windows user.

Now we need to create a container to store our new (and future) users. Navigate to the CN=Sandbox,DC=ITOrg container, right-click on it and select New->Object... Select container and click Next.

Use the name People. Click Next and Finish to create the container.

Next, navigate to the CN=People container, right-click on it and select New->Object... Select user and click Next.

Specify a cn (common name) for your soon-to-be administrator. I used the name superuser.

Then click Next and Finish to create the user.

NOTE By default on Windows Server when ADAM users are created they are disabled. To enable a user, change the value of its msDS-UserAccountDisabled attribute to false.

At this point superuser is not very super. She has no permissions at all in the directory and we have not given her a password so she can't even log in. Let's fix the password problem first. Right-click on this user and click Reset Password...

Click OK. Now our superuser can log in, but can't see or do anything. Let's give her some rights by adding her to the Administrators role, which is in the CN=Roles container.

Right-click on CN=Administrators and select Properties. Scroll to the member attribute and edit it. You'll see the security principal picker. There are two things of note here:

1. You can add two types of users - Windows and ADAM
2. The Administrators group from the Configuration naming context has already been added to this group. For homework, go back to the Configuration naming context and see who is in the Administrators group there.

Click Add ADAM Account... and enter the dn of our superuser (cn=superuser,cn=People,cn=Sandbox,dc=ITOrg)

Next, we will repeat the steps for creating a user to create our service account user. Instead of using superuser, we use ServiceAccount as the user's cn with password p@ssw0rd. Note that we are using the service account user to add new entries in our demo, so we need to add her to the administrative group as well.

Voila! We now have an LDAP user with administrative rights who can bind to our directory using plain text passwords and a service account user who can create new users.

Authenticating with LDAP Client.Net

Since we now have a directory which can be accessed by any LDAP v3 client, let's do just that. We have built a boilerplate ASP.Net application that authenticates using Forms Authentication.

NOTE Forms Authentication is a platform feature of ASP.Net that simplifies building an application with restricted access to selected resources. Specific knowledge of Forms Authentication is not required to follow the remainder of this article (the link provided above is a good starting point for those who want to know more).

There are two tasks required to determine if a user is allowed to access a resource using Forms Authentication

1. Verify that user name and password entered are correct
2. Verify that user belongs to a role that has access to the desired resource

We will use LDAP Client.Net to perform these tasks. The Authenticate method below validates the user's credentials.

private bool Authenticate(string username, string password)
{
    bool authenticated = false;
    //Instantiate LDAP Client.Net.
    using (LdapServices.Ldap.Client client = new LdapServices.Ldap.Client())
    {
        try
        {
            // Connect to the directory as the user who is trying to
            // authenticate. If this fails we know the username
            // and/or password is incorrect.
            LdapConnectionConfigurationSection config = LdapConnectionConfigurationSection.Current;
            //Connect to the directory using the credentials we are trying to authenticate.
            client.Connect(config.Server, config.Port, username, password); 
            // Force a re-fetch of the user's role information.
            LdapRoleCache.Current.Remove(username); 
            authenticated = true;
        }
        catch (LdapException)
        {

An LdapException is thrown if authentication fails using the given username and //password.

            authenticated = false;
        }
    }
    return authenticated;
}

Assuming that the user's credentials have been validated, we need to check which roles the user belong to. The GetRolesForUser method below accomplishes this task.

private string[] GetRolesForUser(string username)
{
    string[] roles = LdapRoleCache.Current[username];
    if (roles == null)
    {
        // Use the LDAP connection information defined in web.config to
        // retrieve the role membership information for this user.
        using (LdapServices.Ldap.Client client = new LdapServices.Ldap.Client())
        {
            LdapConnectionConfigurationSection config = LdapConnectionConfigurationSection.Current;
            client.Connect(config.Server, config.Port, config.User, config.Password);

Get all directory entries whose distinguishedName matches our username. There should only be one.

LdapServices.Ldap.EntryCollection userEntries = client.Search(
config.BaseDn, "distinguishedName=" + username); 
if (userEntries.Count == 1)
{
    // Now retrieve the roles to which this user belongs and
    // store them in the Application object.

The memberof attribute contains a collection of groups the entry belongs to. Each group is considered to be a role.

                // We treat the memberof attribute as the collection of
                // roles to which this user belongs.
                LdapServices.Ldap.Attribute memberOf = userEntries[0].Attributes["memberof"];
                // Copy the values from the memberof attribute into a string
                // array.
                roles = new string[memberOf.Values.Count];
                for (int i = 0; i < memberOf.Values.Count; i++)
                {
                    string adamGroupName = memberOf.Values[i].StringValue;
                    // Roles cannot contain commas in ASP.Net, so we are
                    // mapping commas to periods. The cache contains the
                    // original role names so we need to transform them
                    // before handing them off to ASP.Net.
                    roles[i] = adamGroupName.Replace(',', '.');
                }
                // Save the user's roles in our cache. We will access this
                // cache later during the Application-level
                // AuthenticateRequest event.
                LdapRoleCache.Current[username] = roles;
            }
        }
    }
    // If we could not retrieve the roles for this user then return an
    // empty array, indicating that the user is not a member of any roles.
    if (roles == null)
    {
        roles = new string[] { };
    }
    return roles;
}

Creating users with LDAP Client.Net

The example above shows how to read data from our directory server. In this example, we will use LDAP Client.Net to create new users, modify their password attribute and add them to roles.

The createButton_Click method below is the event handler for creating a new user in our sample application.

protected void createButton_Click(object sender, EventArgs e)
{
    try
    {
        LdapConnectionConfigurationSection config = LdapConnectionConfigurationSection.Current;
        using (LdapServices.Ldap.Client client = new LdapServices.Ldap.Client())
        {
            client.Connect(config.Server, config.Port, config.User, config.Password);
            // Create the user.

A NameValueCollection is used to specify the user's attributes. Each entry in this collection corresponds to a single attribute.

            NameValueCollection attributes = new NameValueCollection();
            attributes.Add("objectClass", "user");
            string userDn = "cn=" + cnTextBox.Text + "," + config.NewUsersContainerDn;

The AddNewEntry method creates a new user with the specified attributes.

LdapServices.Ldap.Entry newUser = client.AddNewEntry(userDn, attributes);

An alternative way to add attributes to an entry is through its Attributes property.

            newUser.Attributes.Add("userPassword", passwordTextBox.Text);
            // Add the user to each specified role.
            foreach (ListItem roleListItem in rolesCheckBoxList.Items)
            {
                if (roleListItem.Selected)
                {

The implementation of AddUserToRole is provided below.

                    AddUserToRole(client, config.BaseDn, roleListItem.Value, userDn);
                }
            }
        }
        this.cnTextBox.Text = string.Empty;
        this.rolesCheckBoxList.Items.Clear();
        this.messageLabel.Text = "User created.";
        this.messageLabel.Visible = true;
    }
    catch (LdapException ex)
    {
        this.messageLabel.Text = ex.ToString();
        this.messageLabel.Visible = true;
    }
}

The AddUserToRole method factors out the code for adding a user to a role.

private void AddUserToRole(LdapServices.Ldap.Client client, string baseDn, string roleDn, string userDn)
{

The user's memberof attribute is read-only, so we have to add the user to the role's member attribute.

    LdapServices.Ldap.EntryCollection roles = client.Search(baseDn,"distinguishedName=" + roleDn);
    LdapServices.Ldap.AttributeCollection roleAttributes = roles[0].Attributes;
    LdapServices.Ldap.Attribute memberAttribute = roleAttributes["member"];

If the member attribute exists then we will add the user to it. Otherwise we have to create the attribute.

    if (memberAttribute != null)
    {
        memberAttribute.Values.Add(userDn);
    }
    else
    {
        roleAttributes.Add("member", userDn);
    }
}