Move on-prem web app from LDAP to Azure AD authentication

Question

Hi All,

Our organization has a really old on-prem IIS ASP.NET web app and the vendor no longer exists; however, it's still heavily used by our users until we have a new solution in place. The application is configured for LDAP authentication via on-prem Active Directory. We're looking to modernize the authentication to this application via Azure SSO. We're syncing our on-prem AD users to Azure AD and our users are already familiar with navigating to MyApps to access several other applications.

We understand that we're probably going to have to modify the source code for the unsupported on-prem web app to switch from LDAP to OpenID Connect or SAML. Does anyone have any recommendations on how to get started to do this?

Thank you in advance.

Answer 1

@GS , Ideally you have two options in hand:

1. Use Azure App Proxy and publish the application so that organization users over the Internet can access it.
2. If you plan to upgrade the authentication mechanism completely from LDAP to one of the Web auth protocols like OAuth, Open ID Connect or SAML then surely you would have to modify the code of the application and make it a claims aware application first.

All these applications that work on either SAML, OAuth or Open ID Connect are claims aware applications what that means is, the application should be able to understand and consume the responses in form of tokens from the IDPs (Identity Providers like Azure AD or ADFS).

I would like to share some sample web applications that are written on the ASP .net framework and implements OpenIDConnect for your reference to understand the structure and the code that you need to implement in your existing application.

https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

Answer 2

I see two options

1. Use Azure AD App Proxy and publish this app over the internet.
   2. You can explore Azure AD Domain Services, which can provide ldap authentication to your apps till the time you modernize the application.