Active Directory login node.js REST basic sample

user_701626 0
Viewed 141

I have a web server based on node.js which provides REST API. Currently it accepts username and password for authentication. There is a .NET client which offers a login form which gathers the data and sends it to the service.

The new requirement is to offer Active Directory authentication, so that users don't have to input usernames and passwords when logging in to the web server, but can be automatically logged in with the credentials they provided when logging to the machine which is a part of Active Directory and has the client installed. The web service machine is also a part of Active Directory.

This seems like a common problem, and in theory does not seem hard:

  1. The user logs in into machine with client installed
  2. The user starts the client, the client acquires security token from the system
  3. The client sends this token to the web service somehow (in the header, body, does not matter, service will know where to read it from)
  4. The service acquires the token and using the data inside it, gets Active Directory username, thus ending authentication phase

It is quite similar to how JWT works which we use now with the difference that security token is generated not by the service, but by Active Directory.

With theory in place I still can't figure out the minimum project which works on these principles. How exactly does .NET client acquires the token? How node.js service is going to validate it and extract username from it? There are bits and pieces across the net, but nothing actually working in this configuration. There are a lot of third party libraries with sspi, kerberos, passport and ldap in names which only make matters worse, I would like to start with a basic sample, which directly uses system APIs, to understand the principle.

node.js ldap rest authentication .net
1 Answers

What you are trying to achieve is not an AAD feature.

  1. AAD provides a JWT (OAuth 2.0) with expiration time to your API using your clientID and clientSecret that comes from your client.

  2. Your API serves this token to your client (I suppose a SPA or web application).

  3. Your web application need to store this token until it expires in the browser Session Storage and check for it everytime needs to send a new request to your API.

  4. You can use the refresh_token in your JWT to obtain a new valid token from your API if the one passed from the client is expired: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#refreshing-the-access-tokens

user_154638770
Related