Form based Authentication with LDAP

  • Thread starter Thread starter Mike Murdock
  • Start date Start date
M

Mike Murdock

I am sure this is a common question but I cannot seem to find the
answer. I am trying to authenticating web users via Active Directory.
I have a basic form where the user types in his username and password
and I need to authenticate the username (sAMAccountName) and password
before letting them into the secure part of the site. Because this is
an classic ASP application I cannot simply apply IIS security to specific
folders and don't want to rely on IIS security at all.

I have seen the example below in several message boards but found that
it only works IF the users CN in the directory is the same as the SAM
account. For example CN=Test and sAMAccountName=Test works but CN=Test
User and
sAMAccountName=Test fails. I surely don't want to have to ask users
for
both names in order to validate them.

What is the proper way to validate the SAM if you do not know the
users CN?

Mike Murdock
Starphire Technologies, LLC
www.starphire.com
email: mmurdock (at) starphire (dot) com

<%
Dim UserName, Password, ldapserver, ldap_path

' Construct the FQDN

ldap_path = "LDAP://192.168.1.123/cn=##,DC=domain,DC=starphire,DC=com;"

'get the ldap server name into local variable by replacing the
special charcter with the username
ldapserver = Replace(ldap_path,"##","testuser")

' Connect to the LDAP Directory

Set dso = GetObject("LDAP:")
'parse the username from the ldap path
userName = Mid(ldapserver, InStr(8, ldapserver, "/") + 1)
'get the password
Password = "testpass"

'Validate the User Name and Password
on error resume next
Set lobjUser = dso.OpenDSObject(ldapserver, UserName, password, 0)

'exit with error - Incorrect username & password - return to
login.asp page
If Err.number <> 0 Then
Response.Write "AUTHENTICATION FAILURE!"
Set lobjUser = nothing
Set dso = nothing
Else
Response.Write "SUCCESS!!"
end if
'To get information from the LDAP directory you need to know the
"attributes"
'available and then you can reference them. Ex:

'strUserName = lobjUser.Get("cn")

%>
 
I have updated the script to make it more generic and work in multiple
domain environments and am posting it here as a resource for other users.

Mike Murdock
http://www.starphire.com
Web Content Management Solutions
mmurdock (at) starphire (d0t) com

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<html>
<head>
<title>LDAP Authentication Test</title>
</head>

<body>

<%
dim submit
dim UserName
dim Password

UserName = "JohnDoe"
Password = ""
Domain = "subdomain.domain.com"

submit = request.form("submit")

if submit = "Authenticate" then
UserName = request.form("UserName")
Password = request.form("Password")
Domain = request.form("Domain")
result = AuthenticateUser(UserName, Password, Domain)
if result then
response.write "<h3>Authentication Succeeded!</h3>"
else
response.write "<h3>Authentication Failed!</h3>"
end if
end if

response.write "<hr><form method=post>"
response.write "<table>"
response.write "<tr>"
response.write "<td><b>Username:&nbsp;</b></td><td><input type=""text""
name=""UserName"" value=""" & UserName & """ size=""30""><br><small>Enter as
""DOMAIN\UserName"" or ""(e-mail address removed)"" or ""\UserName"" in a
single domain environment</small></td>"
response.write "</tr>"
response.write "<tr>"
response.write "<td><b>Password:&nbsp;</b></td><td><input
type=""password"" name=""Password"" value=""" & Password & """
size=""30""></td>"
response.write "</tr>"
response.write "<tr>"
response.write "<td><b>AD Domain:&nbsp;</b></td><td><input type=""text""
name=""Domain"" value=""" & Domain & """ size=""30""><br><small>Enter the AD
Server FQDN, IP Address, or DN<br>Examples: ""adserver1.ourdomain.com"" or
""192.168.1.150"" or
""192.168.1.150/dc=adserver1,dc=ourdomain,dc=com""</small></td>"
response.write "</tr>"
response.write "<tr>"
response.write "<td>&nbsp;</td><td><input name=""submit""
type=""submit"" value=""Authenticate""></td>"
response.write "</tr>"
response.write "</table>"
response.write "</form>"
response.end

function AuthenticateUser(UserName, Password, Domain)
dim strUser
' assume failure
AuthenticateUser = false

strUser = UserName
strPassword = Password

strQuery = "SELECT cn FROM 'LDAP://" & Domain & "' WHERE objectClass='*' "
set oConn = server.CreateObject("ADODB.Connection")
oConn.Provider = "ADsDSOOBJECT"
oConn.Properties("User ID") = strUser
oConn.Properties("Password") = strPassword
oConn.Properties("Encrypt Password") = true
oConn.open "DS Query", strUser, strPassword

set cmd = server.CreateObject("ADODB.Command")
set cmd.ActiveConnection = oConn
cmd.CommandText = strQuery
on error resume next
set oRS = cmd.Execute
if oRS.bof or oRS.eof then
AuthenticateUser = false
else
AuthenticateUser = true
end if
set oRS = nothing
set oConn = nothing

end function

%>

</body>
</html>
 
Back
Top