I am not sure if this is the right place to post this question but I figured since some users here are familiar with Windows Servers and Active Directories, that I might to get some information about my issue.

I am developing an server cloud backup application. The software will be deployed to all users on an Active Directory and the files should be backed up to the cloud under the same account using a single email and password. This is all very trivial and straight forward.

My problem is when a specific (Non-Administrator) user tries to manage his backed up files. I need to differentiate this user on the web console, he needs to enter some credentials that are unique to this user. This is because only the administrator should know the main credentials of the account.

I am leaning on implementing a method that incorporates the account name [username@domain] as the sub-account name and the application will ask the user for a password while the administrator can still access all users' data using the main account's credentials.

I am creating this question mainly to ask what are the best practices for such system as I am not a server expert and haven't done much time with active directory and Windows servers. My main concern is the security of the main account and the sub-users accounts.

closed as off-topic by TomTom, Chris S Mar 14 '14 at 13:58

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    If possible don't use passwords at all. Use some kind of integrated authentication system that link into the AD for authentication. – Zoredache Mar 13 '14 at 16:22
  • @Zoredache do you have an example of such a system? – Zaid Amir Mar 13 '14 at 17:53
  • @RedSerpent Lookup "GSSAPI kerberos" and "windows integrated authentication" – Chris S Mar 14 '14 at 13:50
  • Sorry, but application architecture questions are off-topic for Server Fault. There are existing solutions to your authentication needs, but none of them are simple and the hybrid nature of your application stack is going to complicate deployment (assuming you want to leverage AD for deployment, more than simply installing the software). – Chris S Mar 14 '14 at 13:56
  • This question appears to be off-topic because it is about Application Architecture. You might receive better feedback from Stack Overflow, but I would generally advise picking up a book or two on the topic. – Chris S Mar 14 '14 at 13:58

I'm pretty sure that what you want is not some random username and password. I'm pretty sure that what you want is instead for the software itself to be AD-aware, and to ask the domain controller if the user is valid.

Which isn't the same thing as "web console credentials," alas. But the client software itself should know whether or not the logged in user is valid by standard AD means (valid Kerberos ticket, etc.).

Perhaps you could pull the user's email address from AD and generate a password/OTP for the user that way.

(I would also be nervous about less-savvy users putting their valid AD credentials into your web portal if prompted with DOMAIN/USERNAME, and/or "training them to do so" with third parties. But that's perhaps beyond the scope of what you're asking.)

  • 1
    Let me add as a developer that t his is totally trivial - once you read the documentation. Connect to AD AS THE USER - i.e. with his entered username and password - nd either you get a connection, or a reminder to go away. Or write a portal that integrated into AD (standard setting in IIS, bsaeline for a web developer). – TomTom Mar 13 '14 at 16:45
  • @TomTom what documentation?? – Zaid Amir Mar 13 '14 at 17:55
  • 1
    @RedSerpent .NET has classes for dealing with active directory. In case you do not know, .NET classes have documentation. System.Directoryservices namespace – TomTom Mar 13 '14 at 17:57
  • @TomTom yes I know the classes, I have read the documentation for those. It is finding a good way to implement an authentication system that I am struggling with. I am hoping that someone might direct me to an example/document that shed light on how to create a system that meets my requirements – Zaid Amir Mar 13 '14 at 18:02
  • 1
    well, here is what I use... get a new PrincipalContext and call the ValidateCredentials method on it ;) – TomTom Mar 13 '14 at 18:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.