How to manage users in ASP.NET core with AD / LDAP? Do I store the users in a database?

Question

I am writing an internal app where all the users are part of AD. I have the following steps to implement this. Is this correct?

1. Create Action filter to get all HTTP request to website and check in they are in the specific AD role needed (var isUserInRole = User.IsInRole("M2-ITU-PWApplicationDevelopers"))

2. If user is not in any of the application roles send user to error page

3. If user is in application role then Add users to SQL DB and link to Role table in DB so now I have the user/role data ready to use in DB along with other data

4. When user revisits check the database first before LDAP?

How do I set a cookie or something so that every request does not need through process once authenticated ?

Trying to understand the basics.. Maybe I am going about this all wrong ?

Answer 1

Use Windows Authentication. Your application need to be behind IIS to do it in ASP.NET Core 2.2 and lower, but starting ASP.NET Core 3.0 you can do it with Kestrel alone.

If you do that, you can skip steps 3 and 4. When a person is authenticated via Windows Authentication, the application gets a login token that contains all the security groups that the account is a member of. So User.IsInRole is pretty quick. There is no need to store that information in your own database.

You also don't need to worry about cookies.

The added benefit of Windows Authentication is that it can support seamless login: if your site is in the Trusted Sites in Internet Options, then IE and Chrome will automatically send the credentials of the user currently logged into Windows. The user doesn't have to type in their credentials.

Firefox uses its own network.negotiate-auth.delegation-uris setting for the same purpose.