While working on an Umbraco project, I needed to add a feature, which allowed editors to log in the backoffice using accounts from Active Directory. The requirement was to allow only editors who belong to certain groups in the AD.

The following post from our.umbraco.org contains an example on how to successfully connect to Active Directory, but this standard method does not allow you to specify a group of users: https://our.umbraco.org/wiki/how-tos/membership-providers/active-directory-membership-provider. It  is important to execute the steps at the bottom of the post when you connect Umbraco to your AD.

Standard ASP.NET Implementation

My solutions is based on the following post about the standard ASP.NET integration with Active Directory: https://stackoverflow.com/questions/726837/user-group-and-role-management-in-net-with-active-directory

This is a very good post, but for some reason in Umbraco, the code in ActiveDirectoryRoleProvider never got hit so I moved the functionality to the ActiveDirectoryMembershipProvider.

Solution

ActiveDirectoryMembershipProvider

Following is the code for the ActiveDirectoryMembershipProvider:

public class ActiveDirectoryMembershipProvider : System.Web.Security.ActiveDirectoryMembershipProvider
{
    private string _domain;
    private IEnumerable<string> _allowedGroups;

    /// <summary>
    /// Initialize ActiveDirectoryMembershipProvider with config values.
    /// </summary>
    public override void Initialize(string name, NameValueCollection config)
    {
        if (config == null)
            throw new ArgumentNullException("config");

        _domain = ReadConfigMandatory(config, "domain");
        _allowedGroups = ReadConfig(config, "allowedGroups").Split(',').Select(group => group.Trim());

        // Initialize the abstract base class.
        base.Initialize(name, config);
    }

    /// <summary>
    /// Validate the user.
    /// </summary>
    /// <returns></returns>
    public override bool ValidateUser(string username, string password)
    {
        bool isValid = false;
        try
        {
            using (PrincipalContext context = new PrincipalContext(ContextType.Domain, _domain, username, password))
            {
                if (context.ValidateCredentials(username, password))
                {
                    UserPrincipal user = UserPrincipal.FindByIdentity(context, username);
                    if (user != null)
                    {
                        // Get all direct groups, which the user belongs to.
                        List<string> userGroups = user.GetGroups().Select(g => g.Name).ToList();
                        // Prepare a list with all user groups.
                        List<string> allUserGroups = new List<string>(userGroups);
                        foreach (string userGroup in userGroups)
                        {
                            // Discover all groups, to which the user's groups belong to.
                            RecurseGroup(context, userGroup, allUserGroups);
                        }

                        isValid = allUserGroups.Join(_allowedGroups, r => r, g => g, (r, g) => r).Any();
                    }
                }
            }
        }
        catch
        {
            // TODO: log exception
        }

        return isValid;
    }

    /// <summary>
    /// Reads settings from the config and removes them.
    /// </summary>
    /// <param name="config">The config settings.</param>
    /// <param name="key">The setting key.</param>
    /// <returns>The setting value.</returns>
    private string ReadConfig(NameValueCollection config, string key)
    {
        if (config.AllKeys.Any(k => k == key))
        {
            string value = config[key];
            config.Remove(key);
            return value;
        }
        return string.Empty;
    }

    /// <summary>
    /// Reads settings from the config and removes them. Throws an exception if the setting does not exits.
    /// </summary>
    /// <param name="config">The config settings.</param>
    /// <param name="key">The setting key.</param>
    /// <returns>The setting value.</returns>
    private string ReadConfigMandatory(NameValueCollection config, string key)
    {
        string value = ReadConfig(config, key);
        if (string.IsNullOrEmpty(value))
        {
            throw new ProviderException("Configuration value required for key: " + key);
        }

        return value;
    }

    /// <summary>
    /// Discovers the groups for a group.
    /// </summary>
    /// <param name="context"></param>
    /// <param name="group"></param>
    /// <param name="groups"></param>
    private void RecurseGroup(PrincipalContext context, string group, List<string> groups)
    {
        var principal = GroupPrincipal.FindByIdentity(context, IdentityType.SamAccountName, group);
        if (principal == null)
        {
            return;
        }

        IList<string> newGroups = principal.GetGroups().Select(g = > g.Name)
        // Remove all existing groups.
        .Except(groups).ToList();

        groups.AddRange(newGroups);

        foreach (string newGroup in newGroups)
        {
            RecurseGroup(context, newGroup, groups);
        }
    }
}

Edit: The code between lines 35 and 44 was updated with a bug fix.

Note that you will need to add references to System.DirectoryServices and System.DirectoryServices.AccountManagement.

web.config

Modify your web.config with the following values:

<connectionStrings>
    <add name = "YourADConnectionString" connectionString="LDAP://yourdomain.com/DC=yourdomain,DC=com" />
</connectionStrings>
<system.web>
    <membership defaultProvider = "YourADMembershipProvider">
        <add name = "YourADMembershipProvider"
        type="YourNamespace.ActiveDirectoryMembershipProvider"
        connectionStringName="YourADConnectionString"
        connectionUsername="yourdomain\authorizeduser"
        connectionPassword="yourpassword"
        attributeMapUsername="sAMAccountName"
        enablePasswordReset="false"
        domain="yourdomain.com"
        allowedGroups="Umbraco Users,Other Group" />
    </membership>
</system.web>

umbracoSettings.config

Also modify your umbracoSettings.config with the following values:

<settings>
    <providers>
        <users>
            <DefaultBackofficeProvider>YourADMembershipProvider</DefaultBackofficeProvider>
        </users>
    </providers>
</settings>