How to authenticate using Active Directory in Winforms/C#?

Question

I need to implement authentication using Active Directory for my Winforms application.

I know that it is possible to get current Windows user credential like this:

       AppDomain currentDomain = AppDomain.CurrentDomain;
        // Set the principal policy to WindowsPrincipal.
        currentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);

But I need that system asks user to either:

• select logged in credentials => this would be possible with PrincipalPolicy.WindowsPrincipal I guess
• choose to enter different credentials in Windows login form (not in my application) => how can I get this working?

P.S. I know it is possible to send username/password like it is described here: Validate a username and password against Active Directory? but I don't want to have user credentials going through my application because off security risks

I found out also this project in CodeProject.com on how to authenticate against Active Directory using LDAP, but this also requires entering user credentials in my application...

I know that there is also Active Directory Federated Services, but as far as I know it is for Web based authentication...

Any solutions for desktop authentication against Active Directory?

Answer 1

Here is a method I wrote in VB.NET in the past, and converted to C# for you.
use System.DirectoryServices namespace (you need to make a reference) in order to check credentials of user against DC(LDAP) server in your network (windows network of course).

clarification: this method was requested by our company security department for circumstances that user need to log in to company software from a colleague computer.
i recommend (for security reasons) to require from your IT department to add all users to a specific active directory group and check also if the user is a member of this AD group, also record every local ip address that connects to the software.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.DirectoryServices;

namespace WindowsFormsApplication15
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            if (IsAuthenticated("YOUR DOMAIN", "USERNAME", "PASSWORD") == false)
            {
                // not exist in active directory!
            }
            else
            {
                // user is exist in active directory
            }
        }

        private string _path { get; set; }
        private string _filterAttribute { get; set; }

        public bool IsAuthenticated(string domain, string username, string pwd)
        {
            string domainAndUsername = domain + "\\" + username;
            DirectoryEntry entry = new DirectoryEntry(_path, domainAndUsername, pwd);
            try
            {
                object obj = entry.NativeObject;
                DirectorySearcher search = new DirectorySearcher(entry);
                search.Filter = "(SAMAccountName=" + username + ")";
                search.PropertiesToLoad.Add("cn");
                SearchResult result = search.FindOne();
                if ((result == null))
                {
                    return false;
                }

                _path = result.Path;
                _filterAttribute =  result.Properties["cn"][0].ToString();

            }
            catch (Exception ex)
            {
                return false;
            }

            return true;
        }
    }
}