Authenticate and GetRoles of ActiveDirectory users in a disconnected WPF application via MembershipProvider

Question

I have a project requirement where I need to authenticate against ActiveDirectory in a remote/disconnected WPF application.

There is probably several ways to attempt to do this, but what would be the best approach using ActiveDirectory's MembershipProvider?

I need to:

1. Authenticate that the user exists.
2. obtain the AD user's groups and roles.

This needs to happen from a remote location, outside of the network Active Directory resides on.

Answer 1

From within a WinForms or WPF application you can now take advantage of "Client Application Services" (thanks MS for a very generic name, searching for help is now very painful!).

This allows you to connect to a WCF service that can validate the logins. The link above has a walkthrough that shows how easy it is to get it all working, once you have a working app you can modify your config to point to a different MembershipProvider and/or RoleProvider.

It's worth noting that the out-of-the-box solution includes a MembershipProvider named ActiveDirectoryMembershipProvider, but there's no RoleProvider for Active Directory.

If you do require the ability to get Roles (or Groups) and you are working with .NET 4.0 then you can take advantage of the new Active Directory API added that makes everything much easier, namely System.DirectoryServices.AccountManagement. For the most basic of Membership and Role services you'll want to have the following to create your own basic MembershipProvider and RoleProvider:

• MembershipProvider.ValidateUser() - should use PrincipalContext.ValidateCredentials()
• RoleProvider.GetAllRoles() - use a new GroupPrincipal() as a source to a new PrincipalSearcher()
• RoleProvider.IsUserInrole() - use UserPrincipal.FindByIdentity() method to get a user, use GroupPrincipal.FindByIdentity() to get the group, then use the IsMemberOf() method on the user to see if they're a member of the group.

You can implement as little or as much of the API as needed, you should find everything you need in the new AccountManagement namespace to do this.