Re: ADAM and IIS auth

Writing a role provider for ADAM isn't hard. My co-author and I have an
experimental one we've been giving out to people who ask for it. I could
share it if you are interested.

Still, if you really want to do Windows basic auth and use domain accounts,
that's a pretty easy path to take.

The other super fancy approach is to use the ADFS/web single sign on with
MOSS 2007. That gives you the ability to integrate AD and ADAM in a variety
of different and very flexible ways. It is also by far the most complex
approach though.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Ted" <spamspamspam@xxxxxxxxx> wrote in message
news:eVa$FE0LHHA.2456@xxxxxxxxxxxxxxxxxxxxxxx
Thanks a bunch Lee!

Yes, it's true that you can use membership providers. However for RBAC in
.NET 2 / MOSS you need a Role provider as well, and Microsoft doesn't
provide one for ADAM. So at this time, I think sticking with AD is the
best option.

R
/ Ted


"Lee Flight" <lef@xxxxxxxxxxxxxxx> wrote in message
news:egzyvvzLHHA.3872@xxxxxxxxxxxxxxxxxxxxxxx
Hi

it's true that there are currently no hooks for IIS to do authentication
against
ADAM in the fashion of Windows Intgerated Authentication against a
domain.

However I believe that the authentication provider model for MOSS 2007 is
more flexible as it is built on ASP.NET 2.0 and so can leverage forms
based
auth. I assume this is what the MOSS 2007 LDAP V3 membership provider
uses, see the documentation around:

http://technet2.microsoft.com/Office/en-us/library/23b837d1-15d9-4621-aa0b-9ce3f1c7153e1033.mspxI
do not have any hard experience to offer on this yet as I'm just
gettiongstarted onMOSS 2007 but googling around there seem to be a number
of folks that haveLDAP auth working. Most seem to be testing against AD
over LDAP so ADAMshould be good too, see comments section of
e.g.:http://www.sharepointblogs.com/helloitsliam/archive/2006/08/15/10027.aspxLee
Flight"Ted" <spamspamspam@xxxxxxxxx> wrote in
messagenews:eSce%23DzLHHA.3588@xxxxxxxxxxxxxxxxxxxxxxx>A customer is
considering using ADAM in conjunction with MOSS 2007. I haveadviced
against it, but I'm not an ADAM expert. So I need to get thishypothesis
confirmed:>> When authenticating against AD or a local machine account
the workerprocess of IIS will be passed security tokens for the user and
for thegroups of which the user is a member. When using ADAM, this is not
possible.Correct?>> Specifically, we are going to use BASIC auth and
nested security groups.>> Any input on ADAM and IIS auth would be really
helpful> / Ted>





.

Relevant Pages

  • Re: Group Authentication against ADAM using WSS v3 provider model.
    ... Do you remember what role provider you were using when this was working, ... ADAM) for membership and SQL for roles, ... Joe Kaplan-MS MVP Directory Services Programming ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM and IIS auth
    ... Thanks Joe. ... I'll let you know if we need the role provider - hopefully not. ... if you really want to do Windows basic auth and use domain ... provide one for ADAM. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Authentication Using ADAM ?
    ... Those service all require Windows or Domain authentication by default, ADAM provides ADAM authentication only which is useful inside of ADAM or for applications that don't need Windows auth. ...
    (microsoft.public.windows.server.active_directory)
  • Re: MembershipProvider, ADAM and userProxy
    ... in ADAM via bind proxies and simple bind). ... I have already started working on an ADAM membership ... browse and validate using the Membership provider... ... Except that if I have a user of userProxy class in ADAM, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication Using ADAM ?
    ... able to tell me a couple of 3rd party app name those would use ADAM. ... Joe Richards Microsoft MVP Windows Server Directory Services ... ADAM provides ADAM authentication only which is useful inside of ADAM or ... Anything where you can insert yourself into the auth process you have ...
    (microsoft.public.windows.server.active_directory)