Website + Authentication

[Manny-Tech]

As a school we are moving away from our VLE environment (SharePoint 2013).

 

We have an in-house web developer who has taken all the things we used in SharePoint and developed his own and plonked it onto our website. This side of things doesn't concern me, however, the user authentication and access does. In SharePoint we pulled users and groups from AD we could then manage permissions based on those attributes. We have no such facility currently when we move everything to our website.

 

In the summer we will be moving our website from hosted onto our internal environment. The in-house developer has started work on this and I'm led to believe he has used Webstorm to interact with Node to develop this.

 

Ideally, users would login with their AD credentials, how would we go about this?

 

I appreciate I may not have all the information you require, but I'll do my best to answer any questions.

[danbuntu]

It depends on your setup.

 

 

With have some linux server running PHP applications and we do the auth with ADFS > simplesaml. That lets us do single sign on and pull in any info from AD that we need.

 

We also use ADLAP which is a PHP class that fills in a few gaps for us.

[Manny-Tech]

We have ADFS setup for other services, so potentially that is a route we can use. I guess I need to find from the developer what he has built his website and webapps on.

[Manny-Tech]

Our web platform is built on Node.js using Express.js. Currently using MongoDB to manage the user database. Ideally I want to be copying our AD users into this MongoDB and then using ADFS to authenticate the users.

 

 

I'm not sure this is even possible with MongoDB though?

[danbuntu]

why copy the AD users into mongoDb? Surely you are better just authenticating live against AD?

 

Having them in another system create room for errors, non live and security issues.

[Manny-Tech]

If the web application doesn't have a copy of the users and groups how does it determine what part the authenticating user is and is not able to access?

[Boredguy]

Ideally it would be taking the authentication request and passing it on to the AD to validate, and then it can continue with issuing the credentials as normal.

[Manny-Tech]

That's what I'm hoping to achieve @Boredguy.

 

If user browses to website and website says 'You don't auth here' and sends them off to our ADFS servers to authenticate, when this is then passed back to the website, how do I control students from hitting staff member parts of the site?

[Boredguy]

The way our LDAP authentication works, user credentials are validated as being correct, and then it uses a standard level account to request what groups that user is a member of so that it can restrict or grant site access as required.

[dhicks]

how do I control students from hitting staff member parts of the site?

 

However your in-house developer decides - as pointed out above, the most common solution would be to have the website check group membership for permissions to various sections / functions on the website. You think / hope there'd be a nice framework available that the developer is using for this rather than simply writing it from scratch - even if they simply used file system permissions on the folder structure on your web server, that would be quite simple to implement.

[Manny-Tech]

Are you in a similar position, i.e. web application to access and using ADFS as the gateway to providing authentication to your Active Directory?

 

The position I'm in we have http://www.schooldomain.com for users to browse to. We'll have a /home for all users and a /staff for just staff access I'd imagine there will be a /SLT for the management team too. I'm just struggling to visualise how I can get this node.js application to give access based on attributes of the user. I suppose the biggest flaw is I don't know enough about Node.js.

 

In my head I've got it similar to O365 SharePoint Online. User and relevant attributes such as groups are copied to a database on the web server which is assigned against particular parts of the website. User goes to authenticate, they bounce to the ADFS for validation and then come back to website with token and from there on the website is able to match up the two accounts based on a certain attribute and give them access.

[danbuntu]

So the way we do this in PHP for our webapps is:

 

User goes to the site

 

Simplesaml checks if the user is already logged in

 

The site will try to SSO - it not it pops up a login page/ box

 

Username and password are sent via simple saml > ADFS

 

ADFS checks their login and passed back username, name, email and some other stuff and crucially AD group membership as an array

 

simplasaml now has the user details

 

We then have some Auth classes which check if the user is in a certain group

 

so if they go to the staff page, the class checks if they are in the staff group and lets them in or bounces them. We do this with a database table to hold the groups. So 'staff' might map to 'allStaff, Contractors, sessional' etc.

That way if we need to change access we just change the database and not the code.

 

 

I think the bit you've missed in your post above is that ADFS can send back any of the fields from AD - it's not just authentication.

[Manny-Tech]

My plan was to take name, email, group memberships for starters. As you mention in your steps, it's having a database to store these attributes but crucially whether this node application has the auth classes to check the attributes to give users access to the bits they should have access to.

 

So essentially, I need to find a database for node that will hold the attributes we want from AD and hope the web developer can find something for his node application to check against it.

[Manny-Tech]

I've briefly just read of something call passport npm which maybe something we're after https://github.com/bergie/passport-saml/blob/master/docs/adfs/README.md

 

If we can apply passport npm to each express.js then we can query for specific group memberships such as 'staff' or 'student' or 'admin' etc..

[dhicks]

Are you in a similar position, i.e. web application to access and using ADFS as the gateway to providing authentication to your Active Directory?

 

Me? No, we have a custom component that uses OAuth to authenticate with the VLE - users log in to the VLE, which takes care of permissions.

 

We'll have a /home for all users and a /staff for just staff access I'd imagine there will be a /SLT for the management team too. I'm just struggling to visualise how I can get this node.js application to give access based on attributes of the user.

 

If this is on a machine inside your firewall you can simply make it a domain member and assign appropriate file permissions to the staff / SLT / etc folders, then have the web developer make sure his applications check the current user permissions before giving them access to file / applications in a particular folder. If this is on a Linux server you can make that a domain member to via Samba.