Menu
I am trying develop a simple web service to authenticate users of a desktop application using the windows identity framework, at present I am passing the token generated by WindowsIdentity.GetCurrent().Token via a post variable (it is encrypted and ssl'd, Windows authentication is not an option given the layout of our domain's and the configuration of the server). I am passing the token back fine and converting it back to an IntPtr.
I am at a lost as to how to validate the token to ensure that it was generated by a particular Active Directory (or any for that matter). I have tried to create a new WindowsIdentity instance given the token however that just results in an Exception (message: Invalid token for impersonation - it cannot be duplicated).
If anyone can provide any help or even hints I would greatly appreciated, thanks in advance.
754
There are two steps to verify the token. First, verify the signature of the token to ensure the token was issued by Azure Active Directory. Second, verify the claims in the token based on the business logic. For example, we need to verify the iss and aud claim if you were developing a single tenant app.
The Microsoft identity platform authenticates users and provides security tokens, such as access tokens, refresh tokens, and ID tokens. Security tokens allow a client application to access protected resources on a resource server.
Token validation allows you to create URLs that expire. Tokens are generated within your web application and appended to URLs in a query string. Requests are authenticated at Fastly's edge instead of your origin server.
public bool DoesUserExist(string userName)
{
using (var domainContext = new PrincipalContext(ContextType.Domain, "DOMAIN"))
{
using (var foundUser = UserPrincipal.FindByIdentity(domainContext, IdentityType.SamAccountName, userName))
{
return foundUser != null;
}
}
}
To achieve checking for if a user exists. This comes from the System.DirectoryServices.AccountManagement namespace and assembly.
Just pass in your username which you can get from WindowsIdentity.GetCurrent() and this will return a true/false if a user if in your usergroup. (replace DOMAIN with your needed group name.)
90
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
