Using Active Directory (with LDAP) to authenticate on an angularjs/javascript fronted - what should the flow of the process be?

user_3276362 0
Viewed 1227

I'm working on a project in which we need to authenticate the user in an application by using his/hers windows credentials. Frontend is using Angularjs and backend java.

After doing a sensible amount of research, I discovered that there is no way on the the frontend to obtain directly the Windows user & pass due to security concerns.

But I'm thinking that the whole process should start here, from the frontend, by obtaining these two encrypted credentials or at least a token and sending them to the backend in order to kickstart the ntlm authentication process.

And also, not sure if the user should have to log in the app by typing his windows credentials or if it should automatically be done with ntlm passthrough.

I do not have a good grip on the concept, and that is because most of the related sources that I found are referring to backend solutions (C# 80% of them), but almost nothing for fronted. So, I humbly require some clarifications on this topic. Is there some sort of middleware or npm package that I should use in order to obtain the user & pass, or what would you advise?

angularjs ldap active-directory javascript java
1 Answers

Web servers expose certain server variables to code handling requests they serve.

For me, using IIS, these are described here: https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524602%28v%3dvs.90%29

Since I am using IISNode; my node.js environment is completely embedded into IIS; I have access to these server variables. As the link described, each programming language seems to have their own way to access these variables.

So I would doubt it if Java does not have those as well. The exact code to use will depend on you back end.

But a quick search for "java server variables" already yields me the following:

https://docs.oracle.com/cd/E19534-01/820-3288/gawim/index.html for the java access manager.

http://users.polytech.unice.fr/~buffa/cours/internet/POLYS/servlets/Servlet-Tutorial-CGI-Variables.html for old school JSP.

How can I obtain server variables using apache wicket 1.54? for java wicket server.

So have a look at the documentation of your specific web server software or Java API. There should be a list and example code of how to access these.

Once you obtain this data server side, you can do the LDAP query and then return the results client side.

user_30491270
Related