Active Directory Authentication

[murph]

I have a web app that I'm redesigning that I am having authenticate against AD, simple enough...

But currently the app authenticates against a standard SQL Database which contains the username, user initials, and security level. Do any of you have any recommendations of how to achieve the same functionality in AD? Basically I would need somewhere in AD to store the application security level (unrelated to windows security).

I'm guessing it will come down to just creating some security groups in AD and adding the correct members, but I'd like to avoid that if possible. Any ideas ?

Thanks in advance.

 

[Sgarissta]

I have a web app that I'm redesigning that I am having authenticate against AD, simple enough...

But currently the app authenticates against a standard SQL Database which contains the username, user initials, and security level. Do any of you have any recommendations of how to achieve the same functionality in AD? Basically I would need somewhere in AD to store the application security level (unrelated to windows security).

I'm guessing it will come down to just creating some security groups in AD and adding the correct members, but I'd like to avoid that if possible. Any ideas ?

Thanks in advance.

Your choices are either,create groups containing the people you want, filter for the people you want based on their containers (ou), or extend the AD schema to include a field holding their "security level". The easiest really is the first choice. Then you can do that authentication/authorization via a simple ldap call, and a lookup against the memberof attribute.

 

[mryerse]

I second that, the easiest/best way to do this is make AD groups for the application, one group for each level of access, then add members to the groups as necessary.

 

[murph]

Your choices are either,create groups containing the people you want, filter for the people you want based on their containers (ou), or extend the AD schema to include a field holding their "security level". The easiest really is the first choice. Then you can do that authentication/authorization via a simple ldap call, and a lookup against the memberof attribute.

Actually, I ended up stealing the initials field from the general account info in AD. We don't use it at all internally, so I just made it one long string with their initials and security level. It might not be the prettiest, but it works.

Thanks for the input however.

 

[ekliptikz]

Ah I'm too late, but I have some good input, becuase I just had to do this for a customer a month or two ago. It was for a web-based PERL/mySQL Helpdesk/CRM application that they wanted to authenticate through Active Directory as opposed to registering individual users through the application's interface. So that a user in their domain could just go to their intranet's web adress and automatically have an individual account on this helpdesk software.

(this was a windows server btw)

In order to do this, I used IIS (I think you can use NTLM in apache) to authenticate the user as they entered the root web directory of the helpdesk app. After authentication, their active directory name naturally becomes a environmental variable (in PERL), so I could work with it easily.

At the user's first login, the SQL entry for a user was automatically created (with no password). It was a cheap hack, basically automatically running the registration process and creating a row in the user's table at first login. Each time the user visited the helpdesk, it would see if their AD name had an SQL entry, if it did, it would auto- login them in using a blank password.

Security wasn't a problem, becuase they had to authenticate with their AD name just to get into the helpdesk root directory. And once they were in, the app wouldn't take any user input regarding logging in or out, it only worked with that ENV variable for their AD name.

Success!