Website Authentication to AD

[Manny-Tech]

Hi,

 

As a school we're looking into moving away from our current VLE - SharePoint. We want to start hosting certain services on our own website, but this will require users to login. The simplest method would be to use Active Directory I feel.

 

Our website is currently hosted on a VPS with our provider, so a link directly to our AD already has become a struggle with the website not being hosted internally. I thought maybe we could use something like Windows Azure AD services in the hope we could link our website into AD that way. I'm not sure how possible that is either. Another alternative is to extract users from AD and import this info into some form of database, the only downside being the users would need to create new passwords because I'm fairly sure any form of export from AD wouldn't carry credentials.

 

To be honest, I'm looking for suggestions, or if anyone else has done a similar sort of thing.

 

Thanks

[jamesb]

From the little I know I'd recommend looking into ADFS (Active Directory Federation Services) for this. It'd mean that your authentication actually takes place on your home domain, with the website simply piping requests to you. This way there's no direct link to your internal domain, no credentials being sent back and forth.

 

It does however mean you'd be doing some significant development (depending on what you're using to support your site at the moment), and would need to implement ADFS locally.

 

It is also a relatively cheap option, or can be.

[Arreks]

If you want AD-based authentication, you might want to consider using LDAP in PHP - login authentication is remarkably simple.

[BITS_BryanS]

One option is to create a simple web service that runs internally on your network, and performs the AD authentication locally. This is dead simple in .net for example. You could then just call the service from your website. Nice thing is you'd only need to open https on the firewall. We've done this on our website and works well for us

[iamdannygreen]

If you want AD-based authentication, you might want to consider using LDAP in PHP - login authentication is remarkably simple.

 

I would second this, and recommend taking a look at adLDAP (adLDAP - LDAP Authentication with PHP for Active Directory).

 

I'm currently using adLDAP on two live projects, a helpdesk and behaviour management system. The function classes included cover the majority of what you need and are easy to develop to suit your own needs.

 

The only thing I would say is that if you are allowing off-site access then enable port forwarding for your LDAP connection and come in on a different port, just for added security.