Securing Pages with Active Directory User Groups in ASP.NET Core Blazor Server-Side with Windows Authentication

• ASP.NET Core Blazor Server-Side project set up with Windows authentication enabled
• Access to an Active Directory domain with the necessary user groups created
• A basic understanding of C#, ASP.NET Core, and Blazor

Step 1: Configure Windows Authentication

IF YOU HAVEN’T ALREADY, ENABLE WINDOWS AUTHENTICATION IN YOUR ASP.NET CORE BLAZOR SERVER-SIDE PROJECT BY ADDING THE FOLLOWING CODE IN THE `Startup.cs` FILE:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
        .AddNegotiate();
}

NEXT, IN THE `Configure` METHOD, ADD THE FOLLOWING CODE TO ENABLE WINDOWS AUTHENTICATION:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseAuthentication();
    app.UseAuthorization();
    app.UseEndpoints(endpoints =>
    {
        endpoints.MapDefaultControllerRoute().RequireAuthorization();
    });
}

Step 2: Create an Active Directory User Group

CREATE A NEW ACTIVE DIRECTORY USER GROUP IN YOUR DOMAIN, FOR EXAMPLE, “BlazorAppAdministrators”. ADD THE DESIRED USERS TO THIS GROUP.

Step 3: Create a Policy-Based Authorization

IN YOUR ASP.NET CORE BLAZOR SERVER-SIDE PROJECT, CREATE A NEW FOLDER CALLED “Policies” AND ADD A NEW CLASS CALLED “ActiveDirectoryGroupPolicy.cs”. THIS CLASS WILL DEFINE THE POLICY FOR AUTHORIZING USERS BASED ON THEIR ACTIVE DIRECTORY GROUP MEMBERSHIP:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;

public class ActiveDirectoryGroupPolicy : IAuthorizationPolicy
{
    public async Task EvaluateAsync(AuthorizationHandlerContext context)
    {
        var user = context.User;
        if (user.Identity.IsAuthenticated)
        {
            var groupName = "BlazorAppAdministrators";
            var claims = user.Claims.Where(c => c.Type == "group").ToList();
            if (claims.Any(c => c.Value.Contains(groupName, StringComparison.OrdinalIgnoreCase)))
            {
                return true;
            }
        }
        return false;
    }
}

Step 4: Register the Policy

IN THE `Startup.cs` FILE, ADD THE FOLLOWING CODE TO REGISTER THE POLICY:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthorization(options =>
    {
        options.AddPolicy("ActiveDirectoryGroupPolicy", policy => policy.Requirements.Add(new ActiveDirectoryGroupRequirement()));
    });
}

Step 5: Secure Your Page

FINALLY, SECURE YOUR PAGE BY ADDING THE FOLLOWING ATTRIBUTE TO THE PAGE COMPONENT:

@attribute [Authorize(Policy = "ActiveDirectoryGroupPolicy")]

THIS WILL ENSURE THAT ONLY USERS WHO ARE MEMBERS OF THE “BlazorAppAdministrators” GROUP CAN ACCESS THIS PAGE.

How it Works

WHEN A USER ATTEMPTS TO ACCESS THE SECURED PAGE, THE FOLLOWING PROCESS OCCURS:

1. The user is authenticated using Windows authentication
2. The user’s claims are retrieved, including their group membership
3. The `ActiveDirectoryGroupPolicy` class is called to evaluate the user’s group membership
4. If the user is a member of the specified group, the policy returns `true`, granting access to the page
5. If the user is not a member of the specified group, the policy returns `false`, denying access to the page

Conclusion

AND THERE YOU HAVE IT! YOU’VE SUCCESSFULLY SECURED A PAGE IN YOUR ASP.NET CORE BLAZOR SERVER-SIDE APPLICATION USING AN ACTIVE DIRECTORY USER GROUP WITH WINDOWS AUTHENTICATION. PAT YOURSELF ON THE BACK, FOLKS!

BY FOLLOWING THESE STEPS, YOU’VE TAPPED INTO THE POWER OF ACTIVE DIRECTORY USER GROUPS TO CONTROL ACCESS TO YOUR APPLICATION’S PAGES. THIS APPROACH PROVIDES A HIGHLY SECURE AND SCALABLE WAY TO MANAGE ACCESS CONTROL, ESPECIALLY IN ENTERPRISE ENVIRONMENTS.

REMEMBER TO REPLACE THE “BlazorAppAdministrators” GROUP NAME WITH THE ACTUAL GROUP NAME YOU CREATED IN YOUR ACTIVE DIRECTORY DOMAIN.

HAPPY CODING!

Frequently Asked Question

Get the inside scoop on securing pages with Active Directory user groups in ASP.NET Core Blazor Server with Windows authentication!