I'm currently analyzing the possibility of authenticating users against ADFS using LDAP directly protocol. I understand that ADFS primarily uses protocols like WS-Federation, SAML, and OAuth for authentication. However, I'm trying to determine if there are any scenarios where direct LDAP authentication against ADFS is feasible, even if it's not the typical or recommended approach.

Sample Java code

import javax.naming.Context;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;

public class LDAPAuthenticator {
    public static void main(String[] args) {
        // LDAP connection settings
        String ldapUrl = "ldap://ldap.example:389";
        String ldapUsername = "cn=admin,dc=example,dc=com";
        String ldapPassword = "password";
        String ldapBaseDn = "dc=example,dc=com";

        // User credentials to authenticate
        String username = "john.doe";
        String password = "password";

        try {
            // Create an initial directory context
            DirContext ctx = new InitialDirContext(getLdapEnv(ldapUrl, ldapUsername, ldapPassword));

            // Authenticate the user
            if (authenticateUser(ctx, ldapBaseDn, username, password)) {
                System.out.println("Authentication successful!");
            } else {
                System.out.println("Authentication failed!");
            }

            // Close the directory context
            ctx.close();
        } catch (NamingException e) {
            System.out.println("LDAP error: " + e.getMessage());
        }
    }

    
}

I'm currently analyzing the possibility of authenticating users against ADFS using LDAP directly protocol. I understand that ADFS primarily uses protocols like WS-Federation, SAML, and OAuth for authentication. However, I'm trying to determine if there are any scenarios where direct LDAP authentication against ADFS is feasible, even if it's not the typical or recommended approach.

Sample Java code

import javax.naming.Context;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;

public class LDAPAuthenticator {
    public static void main(String[] args) {
        // LDAP connection settings
        String ldapUrl = "ldap://ldap.example:389";
        String ldapUsername = "cn=admin,dc=example,dc=com";
        String ldapPassword = "password";
        String ldapBaseDn = "dc=example,dc=com";

        // User credentials to authenticate
        String username = "john.doe";
        String password = "password";

        try {
            // Create an initial directory context
            DirContext ctx = new InitialDirContext(getLdapEnv(ldapUrl, ldapUsername, ldapPassword));

            // Authenticate the user
            if (authenticateUser(ctx, ldapBaseDn, username, password)) {
                System.out.println("Authentication successful!");
            } else {
                System.out.println("Authentication failed!");
            }

            // Close the directory context
            ctx.close();
        } catch (NamingException e) {
            System.out.println("LDAP error: " + e.getMessage());
        }
    }

    
}

• java
• ldap
• adfs

3 Answers 3

if there are any scenarios where direct LDAP authentication against ADFS is feasible

Well, the entire purpose of ADFS is to implement "protocols like WS-Federation, SAML, and OAuth" on top of the LDAP-based Active Directory.

So if you use LDAP instead of SAML, then by definition, that's not ADFS authentication anymore – that's just AD authentication.

A lot of systems use LDAP for Active Directory authentication, including many third-party SAML and OAuth IdP software. Since AD does not guarantee any fixed DN format for users (being a very "traditional" directory), the usual process is to 1) bind with a service account (not cn=admin please), 2) search for the user, 3) attempt to bind as the user's account. (That is to say, there's no dedicated "authenticate user" operation; you just try to log in to the LDAP directory as the user.)

It is feasible (and as mentioned, done very often) but personally I would avoid it – I would very much prefer them to use some form of single sign-on if possible, either SAML (via ADFS or via third-party solutions) or Kerberos (aka "Integrated Auth"), so that user passwords would never be exposed to the application. This goes both for web applications and for local ones.

Using LDAP as a make-shift authentication mechanism was never a good idea. It's also slow and difficult to secure properly. Kerberos is really the best option for direct AD authentication. Unfortunately the conventional Java Kerberos toolchain is difficult to use and debug.

If a Servlet Filter would work for you, the Jespa SPNEGO / Kerberos solution is very easy to use by comparison. It's also very good at using Kerberos for form-based logins of you're not interested in "Silent" SSO. It might be the path-of-least resistance for you.

In general, yes, it can be done.

Refer this.