Forms Based Authentication and Active Directory

<< Clearing saved passwords in IE6 and Windows XP | Home | Windows 7 taskbar: recent documents >>

Forms Based Authentication and Active Directory

I recently had to configure Forms Based Authentication for our website (in my case SharePoint, but the same would apply to a plain ASP.NET website) and I wanted to configure it to use Active Directory for the account storage. Our website is going to be accessed at the corporate office, using Windows Integrated Authentication and we’ve set up a separate website pointing to the same content for our extranet users. Both corporate and extranet accounts are going to be stored in AD.

Just for review, FBA uses different providers for different pieces of functionality. The membership provider gives you user accounts. For groups, you’ll need a Role Provider. The third piece can be a profile provider.

The first step I did was to configure the membership provider for Active Directory. There are plenty of examples on the net, so I won’t cover it again here. (Microsoft’s documentation is here.) I got that working fine, so I moved on to the next step, configuring a role provider.

What I soon discovered was that Microsoft doesn’t provide an AD role provider. If you want to pull back group membership, you’ll have to either buy a 3^rd party provider, grab an open source one, or build your own. I was pretty skeptical (and am still thinking I must be missing something), but as of January of this year I couldn’t find an MS role provider for AD.

SO, I used this one: http://www.codeproject.com/KB/aspnet/active_directory_roles.aspx

It’s worked well so far. This provider also has the ability to use a SQL database to cache a user’s roles. They did this after finding that SQL can provide a faster response than AD.

Next month we are going to stress test our application, and I’ll find out how much of a difference the SQL caching makes.

Share This Post:

Print | posted @ Friday, July 17, 2009 8:56 PM

Comments on this entry:

# re: Forms Based Authentication and Active Directory

by Yohan at 10/23/2009 3:13 PM

Hi Kelly,

I've been trying to implement the above mentioned role provider in a WSS 3.0 environment without much success...
Can you give me a bit more insight as to how you got this working?

Thanks!

Yohan

# re: Forms Based Authentication and Active Directory

by Yohan at 10/27/2009 10:21 AM

As discussed with Kelly, here are a few pointers as to how to get the role provider to work (in my case, with WSS 3.0):

When calling the active directory, use the application pool account (see example: http://mindsharpblogs.com/todd/archive/2005/05/03/467.aspx)

In the RoleExists() function, make the comparison case insensitive (rolename.ToUpper() == strRole.ToUpper()).

The people picker in SharePoint seems to match only full group names... if you want wildcard matching, you'll need to tweak the code a bit.

Cheers,

Yohan

# re: Forms Based Authentication and Active Directory

by Nathan at 12/17/2009 3:26 PM

I'm also trying to get this to work with WSS 3.0 but I have been unsuccessful. When I try to bring up the WSS site after putting in this role provider, I get a Sharepoint page with the error "An unexpected error has occurred"... not helpful. Does that mean there is still something wrong in my web.config?

I'm not a programmer. Which directory should the DLL be put into?

Any ideas how I should troubleshoot this?

# re: Forms Based Authentication and Active Directory

by Kelly Jones at 12/22/2009 10:46 AM

I emailed Nathan to see if he had solved his issue (since the error was pretty general, I needed further info to even begin to speculate).

Here's his reply:
---------------------------------------------------
Actually, yes, yesterday I found this article:

http://blog.thekid.me.uk/archive/2007/02/15/a-solution-to-quot-an-unexpected-error-has-occurred-quot-in-wss-v3.aspx

which allowed me to see what the REAL problem was... can you believe it was a lowercase ‘f’ in the word ‘false’?

Thanks for your reply... have a Merry Christmas!

Nathan.