title: Utilizing Active Directory to Authenticate and Authorize an MVC Application
body: <p>I am looking into using our AD structure to Authenticate and Authorize users for accessing an mvc application and its features. I have read multiple articles about how to do this and overall it is straight forward and i even have a working poc. However, the only part that i have seen but do not understand is the concept of a "Role" in AD. A group and a role are considered the same because both end up being a security group in AD. So finally my question is how do you distinguish in MVC an AD Role versus and AD Group. Below are basic snippets from MVC when using AD to Authorize.</p>
  
  <pre><code>[Authorize(Roles="Admin")]
  [Authorize(Group="AppAdmins")]
  [Authorize(Users="username")]
  </code></pre>
  
  <p>I simply don't understand how MVC is able to distinguish Role:Admin from Group:AppAdmins if they are one in the same within AD i.e. security group. Is there a special way to set this up in AD or am i missing something else. Below is another article where they use this Roles concept.
  <a href="https://stackoverflow.com/questions/8184388/asp-net-mvc-using-authorizeattribute-in-multiple-environments-with-windows-aut">Click me</a></p>
  
  <p>Additional Doc for Microsoft on use case.
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles" rel="nofollow noreferrer">Microsoft doc</a></p>