dotnet / dotnet/AspNetCore.Docs

Code example for linux ldap authentication is incorrect

Open
#30,226 4 comments 0 reactions 0 assignees View on GitHub
doc-bug Security-PU Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

Whole section "Kerberos authentication and role-based access control (RBAC)"
https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-7.0&tabs=visual-studio#kerberos-authentication-and-role-based-access-control-rbac
Contains invalid code.
```
if (RuntimeInformation.IsOSPlatform(OSPlatform.Linux))
{
options.EnableLdap(settings =>
{
settings.Domain = "contoso.com";
settings.MachineAccountName = "machineName";
settings.MachineAccountPassword =
builder.Configuration["Password"];
});
}
```
This code will always throw NotSupportedException, because it checks for auth type and credentials. I checked the source code of the library. The only way to make it work currently is to provide code like this:
```
if (RuntimeInformation.IsOSPlatform(OSPlatform.Linux))
{
options.EnableLdap(settings =>
{
settings.Domain = "your.domain";
var ldapConnection = new LdapConnection(
new LdapDirectoryIdentifier("your.domain",true, false),
new System.Net.NetworkCredential("myuser", "my_user_password", "YOUR.DOMAIN"),
AuthType.Basic // Currently only basic auth is supported
);
ldapConnection.SessionOptions.ProtocolVersion = 3;
// This line is important, current version will not work without it
ldapConnection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;
settings.LdapConnection = ldapConnection;
// Enabled querying for user groups and transforming them into claims
settings.EnableLdapClaimResolution = true;
});
}
```

Only `AuthType.Basic` is actually supported. And even after that, when actual user tries to login and the lib is querying DC, it will also fail everytime until you add `ldapConnection.SessionOptions.ReferralChasing = ReferralChasingOptions.None;`
There are no comments about this is the article

---
#### Document Details

⚠ *Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.*

* ID: 401ad9a0-9e51-80a2-5846-82e9790d7257
* Version Independent ID: fbc36c26-9992-1f4c-66d3-02f898ee7ec4
* Content: [Configure Windows Authentication in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-7.0&tabs=visual-studio)
* Content Source: [aspnetcore/security/authentication/windowsauth.md](https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/windowsauth.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-security**
* GitHub Login: @Rick-Anderson
* Microsoft Alias: **riande**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.