Suggested migration from NTLM to modern auth for On Premise web apps in .NET 6

Larry Wildey 11 Reputation points
2021-10-11T16:12:32.443+00:00

We are going to be working on updating a asp.net 4.72 framework web apps and web apis next year. Currently, we are researching the changes in moving to .NET 6 to plan for the migration. One item we would like to tackle is user authentication which is currently using NTLM username/passwords from our AD servers. Is there a path for moving away from NTLM to OpenID Connect that still uses our AD servers or would we need to move all users to Azure AD? We haven't found examples/documentation for the use of Microsoft.Identity.Web on premise.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,817 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
6,831 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,381 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ryan Hill 25,476 Reputation points Microsoft Employee
    2021-10-14T13:41:21.74+00:00

    I'm by no means an NTLM expert, but I would suggest starting with https://learn.microsoft.com/en-us/azure/active-directory/external-identities/hybrid-on-premises-to-cloud. I think synchronizing your on prem AD with Azure AD through Azure AD Connect should allow you to use the AAD provider. Since you're in the exploratory phase, https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-application-authentication-to-azure-active-directory is white paper that discuss this topic that may help provide some direction.

    One you start trying things and run into issues, please do feel free to post those questions on Q&A.

    0 comments
  2. Thameur-BOURBITA 32,496 Reputation points
    2021-10-14T15:52:08.423+00:00

    Hi,
    You have to install Azure active directory to ensure synchronization between on prem AD and Azure active directory

    Azure AD connect provides 3 mechanism to ensure the SSO (single sign on) when you have a prem AD:

    • ADFS : This service will redirect all authentication request to on-prem active directory. This solution is complicated to manage because you have to install a additional servers to install ADFS
    • Password hash synchronization: this solution ensure the passowrd synchronization between the user AD connect and the user account in azure Active directory : whatis-phs
    • PTA : Pass-through authentication :how-to-connect-pta

    Please don't forget to mark helpful reply as answer

    0 comments
  3. Limitless Technology 39,336 Reputation points
    2021-10-15T08:41:09.65+00:00

    Hi there,

    The below documentation might help you in a better understanding of the process.

    NTLM user authentication https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/ntlm-user-authentication

    Migrate application authentication to Azure Active Directory https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-application-authentication-to-azure-active-directory

    NTLM Overview https://learn.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview

    Grant locally-managed partner accounts access to cloud resources using Azure AD B2B collaboration
    https://learn.microsoft.com/en-us/azure/active-directory/external-identities/hybrid-on-premises-to-cloud

    -----------------------------------------------------------------------------------------------------------------------------

    If the reply is helpful, please Upvote and Accept it as an answer

    0 comments