Assign the Same Permissions for All Users of an Active Directory Group

• Dec 28, 2023
• 3 minutes to read

The AuthenticationActiveDirectory authentication type does not support Active Directory Security Groups out of the box. This topic demonstrates how to map XAF security roles to AD groups. When a user logs on for the first time, existing roles with names matching the user’s AD group names are automatically assigned. If the user membership in AD groups was modified, the associated roles collection will be updated accordingly on the next logon.

Note

ASP.NET Core Blazor applications do not support the Active Directory authentication.

• In the module project, reference the System.DirectoryServices.AccountManagement.dll assembly, which provides the UserPrincipal class.

• Inherit AuthenticationActiveDirectory and override the AuthenticationActiveDirectory.Authenticate method:

  C#

  using System.DirectoryServices.AccountManagement;
  using DevExpress.Data.Filtering;
  using DevExpress.ExpressApp;
  using DevExpress.ExpressApp.Security;
  using DevExpress.Persistent.BaseImpl.PermissionPolicy;
  // ...
  public class CustomAuthenticationActiveDirectory : AuthenticationActiveDirectory { 
      public override object Authenticate(IObjectSpace objectSpace) { 
          string userName = GetUserName(); 
          PermissionPolicyUser user = objectSpace.FirstOrDefault<PermissionPolicyUser>(u => u.UserName == userName); 
          if(user == null) { 
              if(CreateUserAutomatically) { 
                  user = objectSpace.CreateObject<PermissionPolicyUser>(); 
                  user.UserName = userName; 
              }                 
          } 
          if(user != null) { 
              foreach(PermissionPolicyRole role in user.Roles.ToArray()) { 
                  if(!UserPrincipal.Current.GetGroups().Any(p => p.Name == role.Name)) { 
                      user.Roles.Remove(role); 
                  } 
              } 
              foreach(string groupName in UserPrincipal.Current.GetGroups().Select(x => x.Name)) { 
                  if(!user.Roles.Any(p => p.Name == groupName)) { 
                      PermissionPolicyRole role = objectSpace.FirstOrDefault<PermissionPolicyRole>(r => r.Name == groupName); 
                      if(role != null) { 
                          user.Roles.Add(role); 
                      } 
                  } 
              } 
          } 
          if(user == null || user.Roles.Count == 0) { 
              throw new AuthenticationException(userName); 
          } 
          objectSpace.CommitChanges(); 
          return user; 
      } 
  }
  

  VB.NET

  Imports System.DirectoryServices.AccountManagement
  Imports DevExpress.Data.Filtering
  Imports DevExpress.ExpressApp
  Imports DevExpress.ExpressApp.Security
  Imports DevExpress.Persistent.BaseImpl.PermissionPolicy
  ' ...
  Public Class CustomAuthenticationActiveDirectory
      Inherits AuthenticationActiveDirectory
      Public Overrides Function Authenticate(ByVal objectSpace As IObjectSpace) As Object
          Dim userName As String = GetUserName()
          Dim user As PermissionPolicyUser = objectSpace.FirstOrDefault(Function(u as PermissionPolicyUser) u.UserName = userName)
          If user Is Nothing Then
              If CreateUserAutomatically Then
                  user = objectSpace.CreateObject(Of PermissionPolicyUser)()
                  user.UserName = userName
              End If
          End If
          If user IsNot Nothing Then
              For Each role As PermissionPolicyRole In user.Roles.ToArray()
                  If Not UserPrincipal.Current.GetGroups().Any(Function(p) p.Name = role.Name) Then
                      user.Roles.Remove(role)
                  End If
              Next role
              For Each groupName As String In UserPrincipal.Current.GetGroups().Select(Function(x) x.Name)
                  If Not user.Roles.Any(Function(p) p.Name = groupName) Then
                      Dim role As PermissionPolicyRole = objectSpace.FirstOrDefault(Function(r as PermissionPolicyRole) r.Name = groupName)
                      If role IsNot Nothing Then
                          user.Roles.Add(role)
                      End If
                  End If
              Next groupName
          End If
          If user Is Nothing OrElse user.Roles.Count = 0 Then
              Throw New AuthenticationException(userName)
          End If
          objectSpace.CommitChanges()
          Return user
      End Function
  End Class
  

• Rebuild the solution.

• Run the Application Designer and replace the AuthenticationActiveDirectory component with the CustomAuthenticationActiveDirectory component from the toolbox (as it is demonstrated in the Pass the Custom Classes to the Security System section of the How to: Use Custom Logon Parameters and Authentication topic).