Is it possible to have Active Directory based Authentication and fall-back to form based Authentication in ASP.NET MVC 3

Question

I have a website redesign that I'm doing at work. Part of the redesign was a switch to a framework (MVC3) something that I'm HOPING to add is the ability for the secure area of the website to auto authenticate users based on our active directory server. However, we also have customers that need access to certain areas as well. I'm wanting to have a fallback to a standard login page that only gets called if it can't authenticate with AD. Has anyone done this/issues you found/etc...

We currently are simply doing standard login procedures, but I'd like to simplify it for the internal employees.

EDIT: I've considered making a separate mvc3 project that simply is for internal use, but was wondering if this was possible for maintainability.

Answer 1

I think what you're looking for is mixed mode authentication.

Similar questions have been asked, like this. and the accepted answer is that it can't be done... However, I know it can be done, because I did a project with mixed mode authentication too.

What I did was:

In the global web.config (so not the one in views\web.config) put:

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>

So by default it will do to your account controller.

Then this is my controller:

[HttpGet]
public ActionResult LogOn()
{
    var loggedinUser = User.Identity.Name;

    // If the logged in user is not empty, the session is not new. 
    // so the user wants to manually log in.
    if (!string.IsNullOrEmpty(loggedinUser))
    {
        new SessionHelper(this).CleanupLeftoverCookies();
        return View();
    }

    // Else try to get the windows login name.
    loggedinUser = Request.ServerVariables["LOGON_USER"];

    // I stored my active directory domain in the settings file, you can probably do this programmatically too
    var domainName = Settings.Default.LDAPDomain;

    loggedinUser = loggedinUser.Replace(string.Format(CultureInfo.InvariantCulture, "{0}\\", domainName), string.Empty);

    // If there is no windows authentication either, let them login manually.
    if (string.IsNullOrWhiteSpace(loggedinUser))
    {
        return View();
    }

    // Else store the windows Authentication in a cookie
    if (ActiveDirectoryAuthentication(loggedinUser, false))
    {
        return RedirectToAction("Index", "Home");
    }
    else
    {
        ModelState.AddModelError(string.Empty, string.Format(CultureInfo.InvariantCulture, "Login using your windows account {0} failed. Please log in manually", loggedinUser));
        return View();
    }
    // And go back home.
}