ASP.NET Core 2 MVC中LDAP/AD URL配置及远程AD多机认证设置问询

Hey there! Let's tackle your questions about setting up AD authentication in ASP.NET Core 2 MVC for domain-joined development machines and customizing LDAP/AD URLs.

Configuring AD Authentication for Domain-Joined Development Machines #

You're right that picking Windows Authentication during project setup works great for IIS Express, but it's not limited to that—we can adapt it for remote AD when all your dev machines are domain-joined. Here's how:

1. Update Authentication Services in Startup.cs
   Replace the default IIS Express auth setup with the Negotiate scheme, which handles Kerberos/NTLM authentication for domain environments:

   using Microsoft.AspNetCore.Authentication.Negotiate;
   
   public void ConfigureServices(IServiceCollection services)
   {
       // Add MVC services
       services.AddMvc();
   
       // Configure AD authentication
       services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
               .AddNegotiate();
   }
   
   public void Configure(IApplicationBuilder app, IHostingEnvironment env)
   {
       // ... other middleware (like error handling)
   
       // Enable authentication before routing
       app.UseAuthentication();
       app.UseMvcWithDefaultRoute();
   }
   

2. Ensure Network & Domain Access
   Since all dev machines are already joined to the domain, the only requirement is that each machine can reach the remote AD server (make sure ports 389 for LDAP or 636 for LDAPS are open). No machine-specific config is needed—domain users will automatically be authenticated when accessing the app.

3. Test the Setup
   Run the app on any domain-joined dev machine, and log in with your domain credentials. The app should recognize your identity without extra prompts (assuming Kerberos is working; if not, it'll fall back to NTLM).

Customizing LDAP/AD URL in ASP.NET Core 2 MVC #

If you need to target a specific AD server (instead of using the current domain's default) or query AD data directly, you'll work with PrincipalContext (from the System.DirectoryServices.AccountManagement NuGet package) or DirectoryEntry:

Option 1: Using PrincipalContext (Recommended for User/Group Operations) #

First, install the NuGet package:

Install-Package System.DirectoryServices.AccountManagement

Then, initialize the context with your target AD URL and domain details:

using System.DirectoryServices.AccountManagement;

// Connect to a specific AD server
var adContext = new PrincipalContext(
    ContextType.Domain,
    "your-ad-server.example.com:389", // AD server URL + LDAP port
    "DC=example,DC=com"               // Distinguished Name of your domain
);

// Example: Verify a user's credentials
bool isValid = adContext.ValidateCredentials("domain\\username", "password");

Option 2: Using DirectoryEntry (Direct LDAP Access) #

For more low-level LDAP operations, use DirectoryEntry:

using System.DirectoryServices;

// Connect to a specific AD server
var adEntry = new DirectoryEntry(
    "LDAP://your-ad-server.example.com:389/DC=example,DC=com",
    "domain\\admin-user", // Optional: Credentials if needed
    "admin-password"
);

// Example: Search for users
var searcher = new DirectorySearcher(adEntry)
{
    Filter = "(objectClass=user)"
};
SearchResultCollection results = searcher.FindAll();

If you need to force authentication to use a specific AD server (instead of the machine's joined domain), you'd need to implement a custom authentication scheme, but in most domain-joined scenarios, the Negotiate setup above will automatically use the domain's AD.

内容的提问来源于stack exchange，提问作者Red Swan