How to integrate Active Directory Authentication into a Web Application (Node.js + LDAP + Azure AD)

In our Enterprise applications we often rely on centralized Identity systems instead of maintaining our own user credentials. One of the most such widely used directory services is Microsoft Active Directory.

By integrating Active Directory in our web applications, we can authenticate users using the organization’s credentials, as organizations maintain centralized Identity Management.

Azure AD vs on-Prem AD

Here we will explore:

• How we can validate users in our using Active Directory
• How to implement the authentication mechanism using Node.js and LDAP
• How to integrate with cloud identity using Microsoft Azure Active Directory (Azure AD / Entra ID)

Why Integration with Active Directory is needed?

Organizations mostly maintain employee accounts inside Active Directory. So, integrating applications with AD provides more flexibility and following advantages.

• Centralized User Management: User Accounts are managed in one place. So users can log in with the same corporate credentials.
• Strong Security Policies: Password rules, expiry rules, and lockout policies will be automatically enforced.
• Automatic Access Revocation: If AD account of an employee is disabled while he/she leaves the organization, then the access to application is also automatically revoked.

High-Level Authentication Flow

High-Level authentication flow

System Architecture

System Architecture

Authentication Protocol

LDAP allows applications to authenticate and query user information from Active Directory. For secure communication, organizations use LDAPS, which encrypts communication with TLS.

Node.js Implementation (LDAP Authentication)

npm install ldapjs express

const express = require("express");
const ldap = require("ldapjs");

const app = express();
app.use(express.json());

const LDAP_URL = "ldap://ad.company.local";
const BASE_DN = "dc=company,dc=local";

app.post("/login", (req, res) => {

    const { username, password } = req.body;

    const client = ldap.createClient({
        url: LDAP_URL
    });

    const userDN = `uid=${username},${BASE_DN}`;

    client.bind(userDN, password, (err) => {

        if (err) {
            return res.status(401).json({
                success: false,
                message: "Invalid credentials"
            });
        }

        res.json({
            success: true,
            message: "Authentication successful"
        });

        client.unbind();
    });

});

app.listen(3000);

Authentication Flow Diagram

Authentication Flow Diagram

AD based Authorization

In enterprise applications the Authentication part only not sufficient. They also require authorization to define Roles and Permissions. In Active Directory, this can be managed through security groups like APP_ADMIN, APP_MANAGER and APP_USER. We can use LDAP search in the application to retrieve group membership like this.

const opts = {
  filter: `(sAMAccountName=${username})`,
  scope: "sub",
  attributes: ["memberOf"]
};

client.search(BASE_DN, opts, (err, res) => {

  res.on("searchEntry", entry => {

    const groups = entry.object.memberOf;

    if(groups.includes("CN=APP_ADMIN")) {
        role = "admin";
    }
  });

});

Benefits of this approach:

• No need to manage roles in the application
• Also this gives flexibility to align with organization’s security policies

Using Azure AD

Many organizations are now moving toward cloud identity platforms such as Azure Active Directory. Instead of directly validating user credentials via LDAP, applications will redirect users to Azure AD for authentication.

This enables:

• Single Sign-On (SSO)
• Multi-factor authentication (MFA)
• Conditional access policies
• Integration with cloud services
• Enable to movement of applications outside the organization

Azure AD typically uses OpenID Connect or OAuth 2.0.

Azure AD Authentication Architecture

Node.js Example Using Azure AD

A popular library for Node.js is Microsoft Authentication Library (MSAL).

npm install @azure/msal-node express

const msal = require('@azure/msal-node');

const config = {
  auth: {
    clientId: "CLIENT_ID",
    authority: "https://login.microsoftonline.com/TENANT_ID",
    clientSecret: "CLIENT_SECRET"
  }
};

const cca = new msal.ConfidentialClientApplication(config);

The Authentication flow will be :

1. User login
2. Redirection to Azure AD
3. User sign in
4. Azure AD returns a token
5. Application creates a session and uses it

This removes the need for direct LDAP communication.

LDAP vs Azure AD (Quick Comparison)

Best Practices

• Always Use Secure Connections such as LDAPS.
• Avoid storing passwords and authenticate directly with AD.
• Manage permissions using AD groups.
• Use Azure AD for Cloud Applications for better security.
• Avoid storing passwords and authenticate directly with AD.

Conclusion

Integrating applications with Active Directory helps in multiple ways such as centralized authentication, improved security and simplified user management. For SaaS and cloud hosted applications, Azure AD provides a platform with built-in Single Sign-On and advanced security controls.

By combining authentication, group-based authorization, and cloud identity, organizations can build secure and scalable authentication systems for modern web applications.