1

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows Authentication.

How it's set up right now is:

 [HttpPost]
 [AllowAnonymous]
 [ValidateAntiForgeryToken]
 public ActionResult Login(LoginViewModel vm)
 {    
     // Removed some details for readability

    if(principalContext.ValidateCredentials(vm.username, vm.password))
    {
        userPrincipal = UserPrincipal.FindByIdentity(principalContext, IdentityType.SamAccountName, vm.username);
    }

    if(userPrinciipal != null)
    {
        TempData["username"] = userPrincipal.LogonName;
        return RedirectToAction("PageForValidatedUser");
    }   
}


public ActionResult PageForValidatedUser()
{
    if (TempData["username"] == null)
    {
        return RedirectToAction("Login");
    }
        string username = TempData["username"].ToString();
        ValidatedUser vu = GetUserInfoByUsername(username);
        ViewModel vm = SetupViewModel(vu);
        return View(vm);
    }
}

And in web.config and in IIS, I set it to Anonymous Authentication.

<authentication mode="None" ></authentication>

The authentication itself is "working fine" with this method, but I'm wondering if it would be a lot more secure if I go with Form Authentication (like this, or this) using the following features:

  • FormsAuthentication.SetAuthCookie for login
  • FormAuthentication.SignOut for logout
  • loginUrl and [Authorize]
kuma
  • 11
  • 2

0 Answers0