The Blog at Jumptree, a guide to project management, business, coding and anything else that we can think of.

I don’t know if I’m just the minority among the ASP.NET developers, but for years, I’ve never had to deal with the Active Directory simply because most projects that I’ve done before were in hosting environments where Active Directory is a luxury to have.

Things are different these days when it comes to support a product like Jumptree Project. Lately, we’ve had quite a few inquires from companies and government agencies where Active Directory authentication is the norm, and such it’s essential for them to link the users in their system with Jumptree together.

So how does a developer—who is not a network admin guru—setup such an environment to develop against Active Directory?

The Hardware

• Machine A Windows 2000 Server — We will setup Active Directory here
• Machine B Windows XP Pro — This will be our client machine where ASP.NET 2.0 will be used to authenticate against the Active Directory
• Router — Connects Machine A and Machine B together.

Setting up Active Directory

Step 1: First you need to configure Active Directory.

Rather than reinvent the wheel, here’s a step-by-step instruction guide by Johannes Helmig that you should follow. Just make sure you reboot the server (Machine A) when you are done.

Step 2: Now to add a user account for our ASP.NET code later to test against. Go to Administrative Tools > Active Directory Users and Computers.

Step 3: Next, expand your domain name and then right-click New > User.

Step 4: The next screen will ask for your first name, last name, full name, user logon name and pre-windows 2000 logo name. Simply entering a name like John Smith or whatever suits your taste.

Step 5: The last step is to create the password for this user account.

Just check the checkboxes User cannot change password and Password never expires for simplicity’s sake and click Finish when you are done.

That’s it for as far as setting up Active Directory goes. Let’s move onto our Machine B where the Windows XP Pro is.

Configuring the client machine

Step 1: On Machine B, right-click the My Computer icon, select the Computer Name tab and click the Change button.

Click on the Domain radio box, and enter the Domain name that was mentioned in Step 3. Click OK afterwards.

Now, you should have everything setup. Reboot the machine and when logging on enter the username that you added to the Active Directory using the domain that you setup earlier.

ASP.NET 2.0 Active Directory with Forms Authentication

When it comes down to it, the only tricky part about using forms authentication against Active Directory is about two configuration sections.

1. ConnectionString
2. Membership Configuration

Here is a sample of my configuration and I’ll explain it afterwards:

<configuration>
<appSettings/>
<connectionStrings>
<add
name="ADConnectionString"
connectionString= "LDAP://NEMOHome.com/CN=Users,DC=NEMOHome,DC=com"
/>
</connectionStrings>
<system.web>
<compilation debug="false" />
<membership defaultProvider="MembershipADProvider">
<providers>
<add
name="MembershipADProvider"
type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="ADConnectionString"
connectionUsername="NEMOHome.com\liming.xu"
connectionPassword="changeme"
/>
</providers>
</membership>
<authentication mode="Forms">
<forms name=".ASPNET" loginUrl="login.aspx" defaultUrl="protected/default.aspx" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>

As you can see, the part around the Authentication and Authorization sections are nothing special, however pay attention to

1. connectionStrings

The syntax of Active Directory starts with LDAP:// followed by the domain name that I mentioned earlier in the article. It’s absolutely important for you to get the domain name right.

The second important element is CN= which stands for user container and in my case it’s Users and the rest of the tokens DC are simply substrings of our domain name.

2. Membership

Now in the membership section, first use this provider:

System.Web.Security.ActiveDirectoryMembershipProvider

…then set the connectionStringName to the connectionString.

Also, the connectionUsername and connectionPassword I used is the account I setup earlier. I’ve seen others use a different user for this, but I’m too lazy efficient, so I just used the one I created before.

When the ActiveDirectoryMembership provider connects to Active Directory, it uses the account whose credentials are specified on the connectionUsername property (note the lower-case n, which is different from the connectionStringName property).

If you specify the connectionUsername property, you must also specify the connectionPassword property, otherwise an exception is thrown.

If you do not specify account credentials, Active Directory uses your ASP.NET Web application’s process account.

From MSDN

And that’s it. Go to your login page and log in as usual and you will see, everything works as expected.

Conclusion

Overall, not bad eh? Hope this guide helps those ASP.NET developers who are trying to get started with Active Directory. I’ve attached the test source files here for you, modify as you see fit.

ActiveDirectory.zip (4 KB)

As of now, Jumptree Project Management does not yet support Active Directory authentication. It will be included however in the next v1.2 release.