[c#] Consulta Login MVC 5.

[Javier Osvaldo Chércoles]

Estimados, buenas tardes, estoy desarrollando un sitio con MVC 5 y quiero agregarle el Login a un Active Directory. Podrian facilitarme algo de información de los puntos a tener en cuenta, tiene presente que el sitio ya esta funcionando, sin ningún tipo de seguridad.

La información seria con relación al agregado de las pantallas, cambios en el codigo y configuración del web.config.

Ya que entre los cambios que ya intente me aparecen varios errores que no me dejan avanzar uno, por ejemplo es el siguiente:

HTTP Error 404.15 - Not Found

The request filtering module is configured to deny a request where the query string is too long.

Most likely causes:

Request filtering is configured on the Web server to deny the request because the query string is too long.

Things you can try:

Verify the configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString setting in the applicationhost.config or web.config file.

Detailed Error Information:

Module   RequestFilteringModule

Notification   BeginRequest

Handler   ExtensionlessUrlHandler-Integrated-4.0

Error Code   0x00000000

Requested URL   http://localhost:8080/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FAccount%252525252525252525252525252525252525252FLogin%252525252525252525252525252525252525253FReturnUrl%252525252525252525252525252525252525253D%25252525252525252525252525252525252525252F

Physical Path   C:\inetpub\wwwroot\EAWeb\Account\Login

Logon Method   Not yet determined

Logon User   Not yet determined

More Information:

This is a security feature. Do not change this feature unless the scope of the change is fully understood. You can configure the IIS server to reject requests whose query string is greater than a specified value. If the request's query string is greater than the configured value, this error is returned. If the allowed length of the query string needs to be increased, modify the configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString setting.

View more information »

Muy Cordialmente.

Javier

[Pablo Pioli]

Estas en un loop infinito donde la pagina de login te redirige a otra que te redirige a la pagina del login.
Evidentemente tenes un problema en la configuracion del middleware de autenticacion.
Pasa como lo estas configurando

Pablo Pioli

[Javier Osvaldo Chércoles]

Gracias Pablo por tu pronta respuesta. Te paso el Web.Config. Te remarco lo que cambie según los ejemplos que vi para conectarme al Active Directory.

 <?xml version="1.0" encoding="utf-8"?>

<!--

  For more information on how to configure your ASP.NET application, please visit

  http://go.microsoft.com/fwlink/?LinkId=301880

  -->

<configuration>

  <configSections>

    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />

    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->

    <sectionGroup name="applicationSettings" type="System.Configuration.ApplicationSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">

      <section name="EAWeb.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />

    </sectionGroup>

  </configSections>

  <connectionStrings>

    <add name="DefaultConnection" connectionString="Data Source=(LocalDb)\v11.0;AttachDbFilename=|DataDirectory|\aspnet-EAWeb-20150226125302.mdf;Initial Catalog=aspnet-EAWeb-20150226125302;Integrated Security=True" providerName="System.Data.SqlClient" />

<add name="ADConnectionString" connectionString="LDAP://ServidorAD.architecture.MiCliente.corp" />

  </connectionStrings>

  <appSettings>

    <add key="webpages:Version" value="3.0.0.0" />

    <add key="webpages:Enabled" value="false" />

    <add key="ClientValidationEnabled" value="true" />

    <add key="UnobtrusiveJavaScriptEnabled" value="true" />

    <add key="MvcSiteMapProvider_UseExternalDIContainer" value="false" />

    <add key="MvcSiteMapProvider_ScanAssembliesForSiteMapNodes" value="true" />

    <add key="MvcSiteMapProvider_IncludeAssembliesForScan" value="EAWeb" />

    <add key="RepositoryEA" value="EAConnectString:EADB --- DBType=1;Connect=Provider=SQLOLEDB.1;Password=SuPassword;Persist Security Info=True;User ID=sa;Initial Catalog=EADB;Data Source=SQLSRV2012CL\DBEngine;LazyLoad=1;" />

    <add key="FolderToExportHTMLReport" value="C:\AppServ\www\EADB" />

    <add key="URLHTMLReport" value="http:\\111.22.333.4:puerto" />

    <add key="EAExporter" value="C:\EAExporter\EAExporter.exe" />    

  </appSettings>

  <system.web>

    <siteMap defaultProvider="MvcSiteMapProvider" enabled="false">

      <providers>

        <clear />

        <add name="MvcSiteMapProvider" type="MvcSiteMapProvider.DefaultProvider, MvcSiteMapProvider" siteMapFile="~/Mvc.Sitemap" />

      </providers>

    </siteMap>

    <authentication mode="Forms">

      <forms defaultUrl="/Home/Index" enableCrossAppRedirects="false" loginUrl="/Views/Accounts/Login"  />

    </authentication>

    <membership defaultProvider="ADMembership">

        <providers>

            <add name="ADMembership" type="System.Web.Security.ActiveDirectoryMembershipProvider,    System.Web,    Version=2.0.0.0,    Culture=neutral,    PublicToken=b03f5f7f11d50a3a" connectionStringName="ADConnectionString" connectionUsername="architecture/administrator" connectionPassword="SuPassword" />

        </providers>

    </membership>

    <compilation targetFramework="4.5" />

    <httpRuntime targetFramework="4.5" />

    <pages>

      <namespaces>

        <add namespace="MvcSiteMapProvider.Web.Html" />

        <add namespace="MvcSiteMapProvider.Web.Html.Models" />

      </namespaces>

    </pages>

        <identity impersonate="false" password="SuPassword" userName="ARCHITECTURE\EAUser" />

  </system.web>

  <system.webServer>

    <security>

      <requestFiltering>

        <fileExtensions allowUnlisted="true">

          <remove fileExtension="." />

          <add fileExtension="." allowed="true" />

        </fileExtensions>

      </requestFiltering>

    </security>  

    <modules>

      <remove name="FormsAuthentication" />

      <remove name="UrlRoutingModule-4.0" />

      <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" />

    </modules>

  </system.webServer>

  <runtime>

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">

      <dependentAssembly>

        <assemblyIdentity name="EntityFramework" publicKeyToken="B77A5C561934E089" culture="neutral" />

        <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Microsoft.Owin.Security.Cookies" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" />

        <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-1.6.5135.21930" newVersion="1.6.5135.21930" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="Antlr3.Runtime" publicKeyToken="eb42632606e9261f" culture="neutral" />

        <bindingRedirect oldVersion="0.0.0.0-3.5.0.2" newVersion="3.5.0.2" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />

      </dependentAssembly>

    </assemblyBinding>

  </runtime>

  <entityFramework>

    <defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">

      <parameters>

        <parameter value="v12.0" />

      </parameters>

    </defaultConnectionFactory>

    <providers>

      <provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />

    </providers>

  </entityFramework>

  <applicationSettings>

    <EAWeb.Properties.Settings>

      <setting name="EAWeb_wcfea_object_Object" serializeAs="String">

        <value>http://localhost:8093/EADataServices.Object.svc</value>

      </setting>

      <setting name="EAWeb_wcfea_package_Package" serializeAs="String">

        <value>http://localhost:8093/EADataServices.Package.svc</value>

      </setting>

    </EAWeb.Properties.Settings>

  </applicationSettings>

</configuration>

---

Subject: [c#] Consulta Login MVC 5.
To: joche...@hotmail.com
From: ppi...@hotmail.com
Date: Thu, 6 Aug 2015 01:21:57 -0300

[Pablo Pioli]

Primero, tengo que aclararte que nunca trabaje con el membership, tengo un framework propio.
Lo que te esta faltando es insertar el middleware OWIN para que te intercepte el flujo OpenID Connect.

Me parece que lo mas facil es crear un nuevo proyecto usando los templates integrados en Visual Studio y de ahi copiar el codigo. A modo de ejemplo, yo uso algo asi (que es algo mas complejo porque tengo varios providers de autenticacion)

appBuilder.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
 
cookieAuthenticationOption = new Microsoft.Owin.Security.Cookies.CookieAuthenticationOptions();
cookieAuthenticationOption.AuthenticationType = CookieAuthenticationDefaults.AuthenticationType;
cookieAuthenticationOption.AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive;
cookieAuthenticationOption.CookieName = "XXXXXXXXX";
cookieAuthenticationOption.ExpireTimeSpan = System.TimeSpan.FromMinutes(5);
appBuilder.UseCookieAuthentication(cookieAuthenticationOption);
 
var azureADOptions = new OpenIdConnectAuthenticationOptions()
{
    ClientId = "xxxx",
    Authority = "xxxxx",
    ResponseType = "id_token",
    RedirectUri = "xxxxxx",
    SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
    AuthenticationType = "AzureAD"
};
 
azureADOptions.Notifications = new OpenIdConnectAuthenticationNotifications()
{
    SecurityTokenValidated = ProcessAzureADLogin  // Opcional, es para poder interceptar y modificar los claims asignados
};
 
appBuilder.UseOpenIdConnectAuthentication(azureADOptions);

Buscaste tambien en
https://github.com/AzureADSamples ?

Requested URL   http://localhost:8080/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLog in%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%2525252525252525252 5 2525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FAccount%252525252525252525252525252525252525252FLogin%252525252525252525252525252525252525253FReturnUrl%252525252525252525252525252525252525253D%25252525252525252525252525252525252525252F

Physical Path   C:\inetpub\wwwroot\EAWeb\Account\Login

Logon Method   Not yet determined

Logon User   Not yet determined

More Information:

This is a security feature. Do not change this feature unless the scope of the change is fully understood. You can configure the IIS server to reject requests whose query string is greater than a specified value. If the request's query string is greater than the configured value, this error is returned. If the allowed length of the query string needs to be increased, modify the configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString setting.

View more information »

Muy Cordialmente.

Javier

[Javier Osvaldo Chércoles]

Nuevamente mil gracias Pablo. La idea seria entonces que cree un proyecto cuando tengo que el elegir la autenticación seria cual? Porque esto esta sobre Windows Server 2012, esto lo aclaro porque el ejemplo describe a Azure.

Gracias y perdon por la ignoracia.

Saludos.

Javier.

---

Subject: [c#] Consulta Login MVC 5.
To: joche...@hotmail.com
From: ppi...@hotmail.com

Date: Thu, 6 Aug 2015 15:39:11 -0300

[Javier Osvaldo Chércoles]

Otra cosa, en que punto se conecta o me conecto con LDAP.

Gracias nuevamente.

[Pablo Pioli]

No termino de entender que queres hacer, LDAP no existe en AzureAD, son bestias diferentes.
Es AzureAD lo que queres usar no?

[Javier Osvaldo Chércoles]

Disculpame Pablo, creo que estoy confundido en los conceptos e incluso un poco desactualizado. El diagrama que tengo es:

Un servidor con Windows Server 2012 con un active directory configurado, al que ya se conecta un Dynamic CRM. La idea es que estoy haciendo una aplicacion usando MVC, y quiero que los usuarios se registren o loguen impactando a ese Active Directory. Por lo que vos me decis no es lo mismo que conectarse a un LDAP.

Cordialmente y mil disculpas por las vueltas.

Javier.

---

Subject: [c#] Consulta Login MVC 5.
To: joche...@hotmail.com
From: ppi...@hotmail.com

Date: Fri, 7 Aug 2015 11:26:17 -0300

[Pablo Pioli]

Es que no es lo mismo active directory que azure active directory. No tenes nada d esto último?

Enviado desde mi Windows Phone

---

De: Javier Osvaldo Chércoles
Enviado el: ‎07/‎08/‎2015 11:41 a.m.
Para: Pablo Pioli
Asunto: [c#] Consulta Login MVC 5.

[Javier Osvaldo Chércoles]

Gracias y perdon nuevamente Pablo, a que te referis con que si tengo. Si es ejemplos, no. Cuando creeo un proyecto en Visual Studio si.

Gracias.

Javier.

---

To: joche...@hotmail.com
From: ppi...@hotmail.com

Subject: [c#] Consulta Login MVC 5.

Date: Fri, 7 Aug 2015 13:21:02 -0300

[Pablo Pioli]

El sitio esta en la misma red que el domain controller?

Enviado desde mi Windows Phone

---

De: Javier Osvaldo Chércoles

Enviado el: ‎07/‎08/‎2015 01:35 p.m.

[Javier Osvaldo Chércoles]

Si Pablo, en la misma red pero en otro servidor. La idea es que un usario del dominio se pueda loguear a la aplicacion con su usuario de red, ya sea el que se logueo al equipo el que ingrese a través de un formulario.

Mil gracias.

Javier.

---

To: joche...@hotmail.com
From: ppi...@hotmail.com
Subject: [c#] Consulta Login MVC 5.

Date: Fri, 7 Aug 2015 17:48:20 -0300

[Pablo Pioli]

Ah, asi es otra cosa, empezaste con Azure Active Directory que no tiene nada que ver.

Si estas en el mismo dominio podes autenticarlos por NTLM directamente, en el IIS activa la autenticacion por Windows y listo.

Si queres loguearlos por un formulario podes usar la API Win32 LogonUser para validar los datos ingresados

Javier.

Javier.

Javier.

Requested URL   http://localhost:8080/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLog in%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%25252 5252525252525252525252525253FReturnUrl%2525252525252525252 5 2525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FAccount%252525252525252525252525252525252525252FLogin%252525252525252525252525252525252525253FReturnUrl%252525252525252525252525252525252525253D%25252525252525252525252525252525252525252F

Physical Path   C:\inetpub\wwwroot\EAWeb\Account\Login

Logon Method   Not yet determined

Logon User   Not yet determined

More Information:

This is a security feature. Do not change this feature unless the scope of the change is fully understood. You can configure the IIS server to reject requests whose query string is greater than a specified value. If the request's query string is greater than the configured value, this error is returned. If the allowed length of the query string needs to be increased, modify the configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString setting.

View more information »

Muy Cordialmente.

Javier