ActiveDirectoryMembershipProvider - IsInRole problem

[David Thielen]

Hi;

For forms/ActiveDirectoryMembershipProvider authentication, I get an
authenticated user but IsInRole fails. I am getting a FormsIdentity where
authentication-"Forms" and name="dave". I do have to enter my domain password
for it to login.

web.config:
<roleManager enabled="true"/>
<authentication mode="Forms">
<forms name=".ADAuthCookie" loginUrl="login.aspx">
</forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
<membership defaultProvider="MyProvider">
<providers>
<clear/>
<add name="MyProvider"
type="System.Web.Security.ActiveDirectoryMembershipProvider,
System.Web, Version=2.0.0.0, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="ADService"
attributeMapUsername="SAMAccountName"
/>
</providers>
</membership>

 

[Dominick Baier [DevelopMentor]]

is the problem on the other thread resolved??

There is no ActiveDirectoryRolesProvider - the roles are not populated from
AD...thats why IsInRole fails.

 

[David Thielen]

Hi;

Yes - windows authentication works 100%.

Yes - ActiveDirectory authentication does authenticate against domain
username and password.

So just this IsInRole issue. How do I get the roles to come from AD?

--
thanks - dave
david_at_windward_dot_net
http://www.windwardreports.com

 

[David Thielen]

ps - the use case for this authentication method is all users are in AD, but
some use firefox or opera as their browser.

--
thanks - dave
david_at_windward_dot_net
http://www.windwardreports.com

 

[Dominick Baier [DevelopMentor]]

right - and i think it is a pretty heavy limitation that there is no AD role
provider...

it is on my todo list - but i haven't found time so far...


You have to fetch them manually - joe knows at least 3 ways to do that

 

[Joe Kaplan \(MVP - ADSI\)]

Yeah, if I had time right now, I'd put one together for you. In the
meantime, you can check out Ryan's blog (www.dunnry.com) and see his
tokenGroups group membership expansion sample. It works quite well. You
could probably roll that into a role provider if you wanted to try.

Ryan and I are together at a conference next week, so maybe we can try to do
something like this? Who knows.

Joe K.

 

[David Thielen]

Hi;

That's amazing that you can authenticate but not authorize from AD - sort of
makes it useless I think except for the case of any AD user is allowed to do
anything...

If you write one, I would be happy to test it.

--
thanks - dave
david_at_windward_dot_net
http://www.windwardreports.com