Multi-tenant login form that validates on Azure AD synchronized from local AD

Question

I have a multi-tenant website built in asp.net and hosted it on Azure.

I want to have a login form that connects to AD to validate a login. I already have the code to do this connecting to a local AD, when hosted in house but now I will want to do it on Azure.

The curveball in this scenario is I want to sync a local AD with Azure AD but each client will have their own local AD.

My questions is, how do you sync multiple clients AD (in different domains) to a single Azure AD, then validate on ASP.NET with the Azure AD. Can this be done?

Answer 1

Re: "The curveball in this scenario is I want to sync a local AD with Azure AD but each client will have their own local AD." I don't know enough about AD to know whether this makes sense directly, but the overall scenario (multi-tenant apps in Azure that allow clients from different ADs to authenticate cleanly in the cloud with the same credentials they use in on-prem AD) can be accomplished.

1. Have each on-prem AD sync with Azure Active Directory. This is done through AAD DirSync tool that each site would need to implement. This (at a minimum) will securely copy key directory properties to AAD for use in the cloud (name, email, a password hash). Note that the AAD instance is unique to each tenant.
2. Set up a multi-tenant application in ASP.NET. IF you have the very latest toolstack for VS, you can do this conveniently within Visual Studio - there's a page in the File New > ASP.NET Application flow that has a button to change the authentication method. Change it to Organization & Mult-tenant. This will update the settings in AAD (which you can then check in the portal in the Active Directory section under manage.windowsazure.com). This should at least show the basic steps. (Be prepared to log into the AAD associated with your app as Global Admin from within Visual Studio since establishing the trust to the app is a privileged operation - and can be adjusted in the portal (such as to add production endpoints).)

Now when you run this application there will be a discovery step - Home Realm Discovery (HRD) - where the end-user logs in with an email (adam@foo.com) which AAD will use to figure out which of the tenants this person is coming from (foo.com, not bar.com) and complete the login flow.

HTH.

Answer 2

You won't be able to sync multiple on-prem AD domains into one single Azure AD (and you probably don't want to either) using DirSync. FIM will let you do this, bit it is design for customers where a single customer has multiple domains/forests, not as a multi-tenant platform.

Use the multi-tenancy authentication option as @codingoutloud suggests. Look into the new SAML authentication options for Office365 (here: http://blogs.office.com/2014/03/06/announcing-support-for-saml-2-0-federation-with-office-365/). For customers who simply don't want to sync their AD you could have them implement on-prem ADFS, which is also able to support SAML.