ActiveDirectoryMembershipProvider Class

Manages storage of membership information for an ASP.NET application in Active Directory and Active Directory Application Mode servers.

Syntax

public class ActiveDirectoryMembershipProvider : MembershipProvider

Remarks

This class is used by the System.Web.Security.Membership and System.Web.Security.MembershipUser classes to provide membership services for an ASP.NET application using an Active Directory (AD) or Active Directory Application Mode (ADAM) server.

Note:

Using an ADAM server requires specific configuration. For more information, see the ADAM Configuration section below.

Note:

The System.Web.Security.ActiveDirectoryMembershipProvider instance works only in the full-trust policy default configuration of ASP.NET. In order to use the System.Web.Security.ActiveDirectoryMembershipProvider instance at any partial-trust level, either you must make changes to the appropriate trust policy file for your application or you must create a "sandbox" assembly that is deployed in the GAC.

The System.Web.Security.ActiveDirectoryMembershipProvider class requires unrestricted System.DirectoryServices.DirectoryServicesPermission permission to run. This permission is not added to any of the partial-trust policy files supplied with ASP.NET. Although adding the System.DirectoryServices.DirectoryServicesPermission permission to a partial-trust policy file will enable use of the System.Web.Security.ActiveDirectoryMembershipProvider class, doing so makes the System.DirectoryServices namespace classes available to any code running in your ASP.NET pages. This option is not recommended for any Web servers that need to run in a secure, locked-down mode.

As an alternative, you can create a "sandbox" assembly that calls the System.Web.Security.ActiveDirectoryMembershipProvider class. This assembly can contain either a wrapper class that forwards method calls to the System.Web.Security.ActiveDirectoryMembershipProvider class or a class that derives from the System.Web.Security.ActiveDirectoryMembershipProvider class. In either case, the wrapper class must assert unrestricted System.DirectoryServices.DirectoryServicesPermission permission. Deploy the sandbox assembly in the GAC and mark the assembly with the System.Security.AllowPartiallyTrustedCallersAttribute (APTCA) attribute. This will enable your partially trusted ASP.NET code to call your wrapper class, and since the wrapper class internally asserts the unrestricted System.DirectoryServices.DirectoryServicesPermission permission, your wrapper class will be able to successfully call the provider

You must create a connectionString entry in the Web.config file that identifies the Active Directory server, Active Directory domain, or ADAM application partition to use. The provider will only operate at domain scope, or in a subscope within a domain. The following table lists allowed connection strings and the scope used.


LDAP://<domain or server>:[port] Port number is optional for ADAM and not needed for Active Directory.	The provider runs against the specified domain or server. With AD, user creation and deletion is done in the default users container. All other operations, including any search methods, will be rooted at the default naming context for the domain. If the connection string specifies an Active Directory domain rather than a specific server and the ActiveDirectoryMembershipProvider.EnablePasswordReset property is true, the System.Web.Security.ActiveDirectoryMembershipProvider instance will always connect to the server with the PDC role for the domain to ensure that password changes take effect and are available when the ActiveDirectoryMembershipProvider.ValidateUser(string, string) method is called. This connection string is not allowed when using ADAM, and will throw a NotSupportedException.
LDAP://<domain or server>:[port]/<container dn> Port number is optional for ADAM and not needed for Active Directory.	The provider runs against the specified domain or server. User creation and deletion is only done in the specified container. All other operations, including any search methods, perform subtree searches rooted at the container. For ADAM servers, the container specifies the root of an application partition, or a container within an application partition. We recommend that the connection string define a specific container to improve performance.

LDAP://<domain or server>:[port]

Port number is optional for ADAM and not needed for Active Directory.

The provider runs against the specified domain or server. With AD, user creation and deletion is done in the default users container. All other operations, including any search methods, will be rooted at the default naming context for the domain.

If the connection string specifies an Active Directory domain rather than a specific server and the ActiveDirectoryMembershipProvider.EnablePasswordReset property is true, the System.Web.Security.ActiveDirectoryMembershipProvider instance will always connect to the server with the PDC role for the domain to ensure that password changes take effect and are available when the ActiveDirectoryMembershipProvider.ValidateUser(string, string) method is called.

This connection string is not allowed when using ADAM, and will throw a NotSupportedException.

LDAP://<domain or server>:[port]/<container dn>

Port number is optional for ADAM and not needed for Active Directory.

The provider runs against the specified domain or server. User creation and deletion is only done in the specified container. All other operations, including any search methods, perform subtree searches rooted at the container.

For ADAM servers, the container specifies the root of an application partition, or a container within an application partition.

We recommend that the connection string define a specific container to improve performance.

The System.Web.Security.ActiveDirectoryMembershipProvider instance maps directory attributes to System.Web.Security.ActiveDirectoryMembershipUser properties. Default attributes are used if no attribute mapping is done in the Web.config file. For more information on attribute mappings, see the individual properties in the System.Web.Security.ActiveDirectoryMembershipUser class documentation.

The following table lists the System.Web.Security.ActiveDirectoryMembershipUser properties and their default attribute mappings.

Note:

The System.Web.Security.ActiveDirectoryMembershipProvider class does not explicitly check that provider attributes are not mapped to core attributes of the user object in the directory. You must ensure that sensitive information from the directory is not exposed through mapped attributes.


ActiveDirectoryMembershipUser.ProviderUserKey	securityIdentifier	No
MembershipUser.UserName	userPrincipalName	Yes, but must be either userPrincipalName or sAMAccountName
ActiveDirectoryMembershipUser.Comment	comment	No
MembershipUser.CreationDate	whenCreated	No
ActiveDirectoryMembershipUser.Email	mail	Yes, but must be a single-valued attribute of type Unicode String.
ActiveDirectoryMembershipUser.LastActivityDate	n/a	Not supported by System.Web.Security.ActiveDirectoryMembershipProvider.
ActiveDirectoryMembershipUser.LastLoginDate	n/a	Not supported by System.Web.Security.ActiveDirectoryMembershipProvider.
MembershipUser.LastPasswordChangedDate	pwdLastSet	No
MembershipUser.PasswordQuestion	none	Yes, but must be a single-valued attribute of type Unicode String.
ActiveDirectoryMembershipUser.IsApproved	User-Account-Control (AD) mDS-UserAccountDisabled (ADAM)	No
MembershipUser.IsLockedOut	computed from lockoutTime and the AD lockout duration (AD on Windows 2000) msDS-User-Account-Control-Computed (AD on Windows Server 2003) msDS-User-Account-Control-Computed (ADAM)	No
MembershipUser.LastLockoutDate	If user is locked out due to too many bad password attempts, the lockout time attribute is returned. If user is locked out due to too many bad password answer attempts, the value stored in the attribute defined by attributeMapFailedPasswordAnswerLockoutTime is returned. If user is locked out due to both a bad password and too many bad password attempts, the most recent date/time value is returned. If the account is not locked out, return 1/1/1754 for SQL compatibility.	No

When both the ActiveDirectoryMembershipProvider.RequiresQuestionAndAnswer and ActiveDirectoryMembershipProvider.EnablePasswordReset properties are true, the System.Web.Security.ActiveDirectoryMembershipProvider class supports password-reset security by requiring the user to answer a predetermined question. To support the question and answer, you must set the following configuration attributes using the add Element for providers for membership (ASP.NET Settings Schema) in the application configuration file.


attributeMapPasswordQuestion	Must be a single-valued attribute of type Unicode String.
attributeMapPasswordAnswer	Must be a single-valued attribute of type Unicode String.
attributeMapFailedPasswordAnswerCount	Must be a single-valued attribute of type Integer.
attributeMapFailedPasswordAnswerTime	Must be a single-valued attribute of type Large Integer/Interval.
attributeMapFailedPasswordAnswerLockoutTime	Must be a single-valued attribute of type Large Integer/Interval.

For more information on using password-reset security, see the ActiveDirectoryMembershipProvider.RequiresQuestionAndAnswer property.

Active Directory connections

When the System.Web.Security.ActiveDirectoryMembershipProvider class is used to connect to an Active Directory or an Active Directory Application Mode (ADAM) server, the connectionProtection attribute that is set using the add Element for providers for membership (ASP.NET Settings Schema) in the application configuration file may restrict the types of operations the System.Web.Security.ActiveDirectoryMembershipProvider class can perform over the connection. The connectionProtection attribute also determines the methods the System.Web.Security.ActiveDirectoryMembershipProvider instance will use to create the connection to the Active Directory or ADAM server.

The following table shows the effect of the connectionProtection attribute when connecting to an Active Directory.


ActiveDirectoryConnectionProtection.None	The System.Web.Security.ActiveDirectoryMembershipProvider class will connect to an Active Directory, with these restrictions. Any method that sets a password will fail. Active Directory requires a secure connection when changing passwords. You must explicitly set the connectionUsername and connectionPassword attributes using the add Element for providers for membership (ASP.NET Settings Schema) in the application configuration file; otherwise, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception.
Secure	The System.Web.Security.ActiveDirectoryMembershipProvider class will attempt to connect to Active Directory using SSL. If SSL fails, a second attempt to connect to Active Directory using sign-and-seal will be made. If both attempts fail, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception. Both process credentials and explicit credentials are supported.

ActiveDirectoryConnectionProtection.None

The System.Web.Security.ActiveDirectoryMembershipProvider class will connect to an Active Directory, with these restrictions.

Any method that sets a password will fail. Active Directory requires a secure connection when changing passwords.
You must explicitly set the connectionUsername and connectionPassword attributes using the add Element for providers for membership (ASP.NET Settings Schema) in the application configuration file; otherwise, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception.

Secure

The System.Web.Security.ActiveDirectoryMembershipProvider class will attempt to connect to Active Directory using SSL. If SSL fails, a second attempt to connect to Active Directory using sign-and-seal will be made. If both attempts fail, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception.

Both process credentials and explicit credentials are supported.

The following table shows the effect of the connectionProtection attribute when connecting to an ADAM server.


ActiveDirectoryConnectionProtection.None	The System.Web.Security.ActiveDirectoryMembershipProvider class will connect to an ADAM server, with this restriction. Any method that sets passwords will fail unless you explicitly configure the ADAM server to allow passwords to be sent and changed over an insecure connection. Both process credentials and explicit credentials are supported.
Secure	The System.Web.Security.ActiveDirectoryMembershipProvider class will attempt to connect to the ADAM server using SSL. If a connection cannot be made, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception. Both process credentials and explicit credentials are supported.

ActiveDirectoryConnectionProtection.None

The System.Web.Security.ActiveDirectoryMembershipProvider class will connect to an ADAM server, with this restriction.

Any method that sets passwords will fail unless you explicitly configure the ADAM server to allow passwords to be sent and changed over an insecure connection.

Both process credentials and explicit credentials are supported.

Secure

The System.Web.Security.ActiveDirectoryMembershipProvider class will attempt to connect to the ADAM server using SSL. If a connection cannot be made, the System.Web.Security.ActiveDirectoryMembershipProvider instance will throw a System.Configuration.Provider.ProviderException exception.

Both process credentials and explicit credentials are supported.

ADAM Configuration

When using an ADAM server, the ADAM instance must contain a schema that defines the User class. You can import the User class with an LDIF import of the MS-User.ldf file available in the ADAM install directory.

The System.Web.Security.ActiveDirectoryMembershipProvider class will work with an ADAM server configured to use the default network ports. The following table shows the defaults expected for the ADAM server.


ActiveDirectoryConnectionProtection.None	389
Secure	636

If your ADAM server is not using the default ports, see article Q817583, "Active Directory Services does not request secure authorization over an SSL connection," in the tp://go.microsoft.com/fwlink/?linkid=37115.

Requirements

Namespace: System.Web.Security
Assembly: System.Web (in System.Web.dll)
Assembly Versions: 2.0.0.0
Since: .NET 2.0