Integrate on-premises ad with asp.net web application

Active Directory supports OpenID authentication using Bearer token. So there is no difference between Azure Clod AD or OnPrem AD interms of configuration inside asp.net app.

 

On Prem AD is usualy managed by company IT team and you wont have full access to it. You can only allow users from AD to login to your app, you cannot create new users or delete new users. However once the user has logged in for the first time then you need to create a proxy user record in your app and assign roles and permissions. This can be done by listening to "options.Events.OnCreatingTicket" event. 

 

This on prem AD integration will be in addition to your exiting login, so app admin will still be present and can be used to login and assign roles to on prem proxy users created in your app.

 

Sample Code

 

 

context.Services.AddAuthentication()
            .AddJwtBearer(options =>
            {
                options.Authority = configuration["AuthServer:Authority"];
                options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]);
                options.Audience = "Store";
                options.BackchannelHttpHandler = new HttpClientHandler
                {
                    ServerCertificateCustomValidationCallback =
                        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
                };
            }).AddOpenIdConnect("AzureOpenId", "On Prem AD Login", options =>
            {
                options.Authority =  configuration["AzureAd:AdUrl"] ;
                options.ClientId = configuration["AzureAd:ClientId"];
                options.ClientSecret = configuration["AzureAd:ClientSecret"];
                options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
                options.CallbackPath = configuration["AzureAd:CallbackPath"];
                options.RequireHttpsMetadata = false;
                options.SaveTokens = true;
                options.GetClaimsFromUserInfoEndpoint = true;

                options.Scope.Add("basic");
                options.Scope.Add("email");
                options.NonceCookie.SameSite = SameSiteMode.None;
                options.CorrelationCookie.SameSite = SameSiteMode.None;

                options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
                    options.ClaimActions.MapJsonKey(ClaimsIdentity.DefaultNameClaimType, "login");
                    options.ClaimActions.MapJsonKey(ClaimTypes.Email, "email");
                    options.ClaimActions.MapJsonKey("ClaimTypes.UserName", "name");
                    options.ClaimActions.MapJsonKey("ClaimTypes.Phone", "phone");

                    options.ClaimActions.MapJsonKey("ClaimTypesEmail", "email");

                    options.Events.OnCreatingTicket = async context =>
                    {
                        // Get the GeoWiki user
                        HttpRequestMessage userRequest = new HttpRequestMessage(HttpMethod.Get,
                            context.Options.UserInformationEndpoint + "?access_token=" +
                            Uri.EscapeDataString(context.AccessToken));

                        userRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                        HttpResponseMessage response =
                            await context.Backchannel.SendAsync(userRequest, context.HttpContext.RequestAborted);
                        response.EnsureSuccessStatusCode();

                        JsonElement user =
                            JsonSerializer.Deserialize(await response.Content.ReadAsStringAsync());
                        context.RunClaimActions(user);
                    };
            });

 

If you can get email/phone number from AD then you can send sms/email using external services like Tilio sendgrid- https://www.twilio.com/sendgrid/email-api