CODEWITHSUNDEEP
adfs
tech360
tech360

Reputation: 31

Retrieving all users and roles in a .NET Web Application through ADFS

We have a hosted .NET web application (Windows Server 2012 R2 environment) and we need to provide Single sign-on (SSO) to users from a corporate LAN environment. We have used ADFS to enable SSO and it is working as expected thus when a user hits our web application login page URL he is authenticated against ADFS and is automatically logged in to the application.

We have an additional requirement where we need to obtain a list of all users, their groups, email addresses some additional information periodically from their Active Directory so that this information can be bulk loaded into our web application however since ADFS is implemented we do not have direct access to the Active Directory.

  1. Is it possible to connect to ADFS and obtain a list of all users, their email addresses etc. programmatically?

  2. If the above is not possible then what is the recommended approach for this kind of a setup?

Thank you.

Upvotes: 0

Views: 1339

Answers (2)

jjczopek
jjczopek

Reputation: 3379

As Alex mentioned above - the way it works, ADFS does not provide any way of importing data from the AD or other trust stores. It just gives you the information that are carried over with the token.

In case you need more information, you should extend the number of claims being issued by ADFS. You can then collect the information - when the user comes for the first time, use the data from the token and fill the profile. If it is returning user - update the information if necessary.

The other solution (but I wouldn't say it's recommended - rather a workaround) would be to implement custom solution for importing information from AD to your application. I'd say it's fair as long as you use your local AD for reading this data. In the moment you decide to extend the access to third party (e.g. partner company), which might be using different identity provider, which doesn't have to be backed by Active Directory any more - you find yourself in tough spot.

Upvotes: 0

Alex
Alex

Reputation: 391

  1. No, this is not possible. There is no such API because with SAML and WS-Federation, users can come from anywhere. This does not have to be AD, technically it's possible create a "Log in with Facebook" implementation.
  2. What would you need the information for? The user's claims contain all information which you might need (user name, e-mail address, group memberships).

If you really need that information about all users in your application, perhaps ADFS is not the solution you are looking for.

Upvotes: 1

Related Questions