I want to start a new asp.net mvc5 Personal Appraisals web project. Now I will have a module inside the system for managing users, and adding info such as primary role, secondary role, main skills, rating for each skill.

As the users are already inside the active directory so I do not want to store duplicate info such as their first name, last name, email address, I want to retrieve them directly from the AD. So I am thinking of this scenario:

  1. Click on "Add user".
  2. Start typing first name, where the system will auto-complete the related users from AD.
  3. Select specific user. The system will populate its first and last names + email address.
  4. Enter info such as primary role, main skills, etc.
  5. Save
  6. After that I will ONLY save the GUID for the user or any id that uniquely identify the user inside the AD.
  7. Later on when I want to view the users info, I will dynamically retrieve his first name, last name, and email address from the AD based on the GUID id which i store inside my DB, and display them inside my system + the info which is stored inside my DB (such as primary role, skills, etc).

So can anyone advise on this approach, or is it better to store the users' info inside my system, and define a sync job which will synchronize the users as defined inside the AD? I'm not sure how I should be handling this scenario. Thanks.

  • This would be to short for an answer, I like your idea. You only need a unique ID. The username would be a good one :)
    – Knerd
    Dec 11, 2014 at 17:05
  • @Knerd but i am afraid that in my approach it will be difficult to mange user info, because some info will be inside AD (Fname,email address) while other info such as (achievement rank, number of completed projects) will be stored inside my own DB. so this will complicate sort, filter, search functions, because data will be divided inside two data sources; AD & my own DB. so i am thinking of another approach, is to create a table named ADUsers inside my system, and develop a sync job which will query the AD users and populate my ADUsers table accordingly. can u adivce ?
    – test test
    Dec 15, 2014 at 13:07
  • The sync doesn't sound to bad, I don't have enough experience with this topic. I would just use a connection field like username or so.
    – Knerd
    Dec 15, 2014 at 13:15
  • @Knerd i usually only answer questions that i have enough experience and knowledge on it :) ,otherwise i will not be very helpful...
    – test test
    Dec 15, 2014 at 15:48
  • I just recently build an app, with node, that uses AD auth, so I just told you what I did ;) I basically used the username as my identifier. Works good :)
    – Knerd
    Dec 15, 2014 at 15:52

2 Answers 2


I think you should store all the data you will need to properly draw UI inside your database and synchronize it with AD. Otherwise very soon you will stumble over performance issues. Sync with AD sounds good for me. And as to when to sync, check this Microsoft article. There are techniques for this inside AD.


Its a slightly confused message from Microsoft. One the one hand, storing custom schemas in AD seems an ideal place to put it, but on the other hand they don't want you to do it. AD guides note that while you can add schemas to AD, you can never remove them afterwards. This makes Admins nervous. I wouldn't want to have a central user audth system that ends up growing with extraneous data you could never prune or tidy up if you stop using the application that required it.

What they have produced is an AD-lite system (called ADAM) that you can link to your AD so AD holds the users, and ADAM holds the custom data. I never quite got it to work, the tooling to manage the system is poor, and even if you do put your custom data in it you have to jump through a lot of hoops to make it accessible to the AD admins (which is the point of putting it in there - single point of administration of user data)

I would strongly recommend using a normal database to hold your custom data. Put a primary key that corresponds to the user's GUID and read your data in 2 phases, read/authenticate the user, and then use the user GUID to read the custom data from your DB as normal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.