Active Directory Integration with Identity Server

[shahjeet297]

We are planning to use the latest version of duende identity server.

.Net 6.0

We would like to integrate with Active Directory and do the password management UI for the same.

Please suggest a better approach how we can access the Active Directory to validate the credentials and set the credentials if user reset their password.

[josephdecock]

The appropriate way to integrate with "Active Directory" depends on if you are referring to Azure AD or a traditional Active Directory (on prem)?

To integrate Azure AD with IdentityServer, you add the microsoft authentication handler, configure it, and then invoke the external authentication process by challenging the handler's scheme.

To integrate with on prem Active Directory, one option is to use Windows Authentication (appropriate on an intranet where everything is joined to a windows domain). Alternatively, your login page could take in the username and password, and check those credentials against active directory using LDAP.

Fundamentally, however you authenticate the user, the ultimate job of the login page is to issue the IdentityServer session cookie and redirect back to the IdentityServer middleware. From the point of view of the IdentityServer engine, the storage of users and validation of their credentials is just an implementation detail of the login page.

Microsoft has lots of resources on Active Directory. Here are some to get you started:

• https://learn.microsoft.com/en-us/aspnet/identity/overview/getting-started/developing-aspnet-apps-with-windows-azure-active-directory
• https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-8.0&viewFallbackFrom=aspnetcore-2.2&tabs=visual-studio
• https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=dotnet-plat-ext-8.0

[RolandGuijt]

I'm assuming Joe's comment helped so closing for now. Feel free to re-open if you have something else around this issue.