This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 35%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFR%3C/text%3E%3C/svg%3E)
We are beginning to consider writing some new apps using Blazor and .NET 8. I've played around with the beginner's tutorials, which are nice, but not enterprise quality. One of my colleagues has been experimenting with Blazor. He has approached it from the angle of authentication and authorization. In his experimentations he found that he could authenticate to our Active Directory servers, but he couldn't retrieve anything about the AD Groups the user is in. I tried duplicating what he did, by creating a new Blazor app using .NET 8, then I chose "Individual" for authentication. (The only other option was "None", which I didn't want to do.) I discovered the same thing, when running it. It popped up a window informing me that I was authenticated, but I suspect I, too, couldn't get a listing of all the AD Groups I'm a member of, in our domain. Please note that we do NOT want to use Azure AD! At this point we don't have an Azure tenant and I'm not sure if, or when, we'll have one. This must work with Windows Servers AD on-prem.
We're wondering, is it even possible to determine the AD Groups a person is a member of, in a Blazor app, written in .NET 8?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 61%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
Only server blazor can access the ad directly, a WASM would need to call an api. Second you want Windows authentication, not individual. Individual uses a database to define users and passwords. To add Windows authentication see:
When trying a new project, only individual or none is specified for authentication. However, that might be because I've chosen the option to create it either as a server or client Blazor app. If I were to create the app strictly as a server Blazor app, then I'm guessing that would allow me to specify Windows authentication, correct?
You pick none, then manually add the windows authentication support per docs.
Bruce, your answer looks like it will do what I want to get done. Thank you!
I'm wondering if I could use two apps, in conjunction with each other. One being a server-side Blazor app, or maybe an API that would perform Windows authentication. It would fetch all the AD Groups the user is a member of, and return that to the calling app, which would be a Blazor that with Auto for authentication, so it could do both client and server processing. Does that make sense?
If you used client interactive, and pre-render, with Windows’s authentication, then the pre-render code would have access to the user and claims. It would then need to persist prerender state to the client app (which is another request). The client app would load the render state. You could use custom authentication in the client app to use the prerender state.
https://learn.microsoft.com/en-us/aspnet/core/blazor/components/prerender?view=aspnetcore-8.0