User Authentication for .NET Enterprise Portal

For a Microsoft-centric enterprise intranet environment using SQL Server and ASP.NET applications, the following authentication solutions are recommended:

• Microsoft Entra ID – The preferred choice for most organizations due to its strong security, cloud-native capabilities, and seamless integration with Microsoft technologies.

• Active Directory Federation Services (AD FS) – A suitable option when cloud-based identity services are not permitted and authentication must remain entirely on-premises.

• Keycloak – A robust open-source identity and access management platform that supports modern authentication standards and single sign-on.

• Okta – A leading third-party identity provider offering enterprise-grade security, scalability, and extensive integration capabilities.

For organizations modernizing ASP.NET Web Forms applications in 2026, Microsoft Entra ID combined with OpenID Connect (OIDC) is generally the recommended approach. It provides a secure, standards-based authentication framework, supports Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access policies, and offers a clear modernization path for both legacy and modern applications.

If the goal is to keep it simple, secure, and minimize changes to the existing ASP.NET Web Forms applications, then I would recommend choosing one of these approaches:

Windows Authentication (Simplest for Intranet) - If all users are employees and use domain-joined computers:

User logs into Windows

|

v

ASP.NET Application

|

Active Directory

For a legacy ASP.NET Web Forms intranet application, the most secure and future-proof approach is to move away from Forms Authentication and adopt a standards-based identity provider (IdP) using OpenID Connect (OIDC) and OAuth 2.0.

Startup.cs

using Microsoft.Owin;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using Owin;

[assembly: OwinStartup(typeof(MyPortal.Startup))]

namespace MyPortal
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.UseCookieAuthentication(
                new CookieAuthenticationOptions()
            );

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = "client-id",
                    Authority = "https://login.microsoftonline.com/tenant-id",
                    RedirectUri = "https://portal.company.gov/signin-oidc",
                    ResponseType = "id_token"
                });
        }
    }
}

Login Button

protected void btnLogin_Click(object sender, EventArgs e)
{
    Context.GetOwinContext()
        .Authentication
        .Challenge(
            new AuthenticationProperties
            {
                RedirectUri = "/Home.aspx"
            },
            OpenIdConnectAuthenticationDefaults.AuthenticationType);
}

Logout

Context.GetOwinContext()
    .Authentication
    .SignOut(
        CookieAuthenticationDefaults.AuthenticationType,
        OpenIdConnectAuthenticationDefaults.AuthenticationType);

Microsoft Entra ID (or ADFS if cloud usage is restricted) + OpenID Connect + OWIN middleware, with all applications federated to the same identity provider for true SSO.