c# - Authentication with Active Directory by multiple clients -
a client work have existing active directory employee information, want create application can log in using information stored in active directory. application should have web (.net), mobile (android , iphone), , optional desktop interface.
i haven't worked active directory before. did study on active directory, , here's understand far:
there 2 ways authenticate active directory:
- by ldap : .net, can use
system.directoryservices
(and
system.directoryservices.accountmanagement
) namespace classes to
perform authentication. android, iphone, guess have some
libraries in platform ldap query active directory (any suggestion?) - by adfs identity provider: understand, adfs extension ad provides sso feature, , can configured identity provider, correct? , .net, android, iphone clients can use libraries oauth/openid authentication active directory through adfs
is understanding above correct? , way better? why should 1 use 1 not other? how azure ad come picture?
basically yes.
adfs 3.0 supports oauth2 - earlier versions don't.
note there number of identity providers can use ad e.g. shibboleth , pingfederate.
if want sso , if .net application claims based (i.e. wif) use adfs. outsource authentication trusted , verified security system , signed token contains whatever ad attributes require. adfs provides ability federate other sts e.g. azure ad.
in terms of mobile, have @ azure ad authentication library .net.
with ad have yourself. it's ad attributes. , need think how ensure security.
with adfs, can synch users aad , hence use on-premise credentials in cloud.
Comments
Post a Comment