.netmembershipactivedirectorymembership

active directory membership provider and user data


If I'm using active directory as a user store, how do I relate information in my database to a particular user? Should I insert them into the database after authenticating them ( which seems redundant to me) or is using the ad membership provider only for authentication and I should be using the SQL membership provider?


Solution

  • Membership providers are only concerned with authentication. Authorization (which is not the same thing as authentication) is performed by your logic, optionally with a Roles provider.

    You can use Active Directory for roles, but you'll need to use an external implementation as ASP.NET does not include one out-of-the-box (e.g. http://www.codeproject.com/Articles/28546/Active-Directory-Roles-Provider ).

    If you're using AD for membership but want to track users in your database then you'll want to use an AD user's objectGUID attribute because it's both unique and immutable, other properties like cn and objectSid are unique but are not immutable.

    Personally I do not use the Membership/Roles/Profiles features in any ASP.NET project I work on because they require special handling which creates a logically-separate concern in your application that doesn't always mesh with everything else in your application, especially if you're using an ORM for your entities. Even if you implement your own providers to avoid complications with your application's internal entity model you will still run into problems because the Membership object exposes a new interface to your model which you still need to implement on top of any existing system for user management you have. Consequently I only recommend using Membership/Roles/Profiles for ultra-basic websites.