IIS在多域林中使用ASP.NET应用的Windows身份验证问题

Question

I am trying to implement a web-based intranet project that uses Windows Authentication. The web server (Windows 2012 Server) is in Domain A, but I need to be able to access the site from computers in any domain within the forest. I am just testing this using computers in domains A and B.

In IIS 7.0, I have enabled Windows Authentication and disabled all others, including Anonymous Authentication. In web.config I have:

<authentication mode="Windows"></authentication>
<identity impersonate="true" />
<authorization>
  <deny users="?" />
</authorization>

Authenticated users need to be in AD group "TestGroup"; I removed the <allow groups="TestGroup" /> in web.config for testing purposes; I also added a few labels on home page to display my user's ID, groups I belongs to, all members of "TestGroup" and whether I am a member of "TestGroup" or not, jut for debugging purposes.

I believe I have done everything correct so far. With web.config as is:

• When I access from a PC in domain A, I am not prompted to log in (whihc is correct since I am already logged in to domain A), and all lebles show correct data.
• When I access from a PC in domain B, I am asked to log in (correctly), user ID label shows my ID correctly but shows no groups for my user ID and no group members in "TestGroup".

If I remove the identity section in web.config:

• When access from a PC in either domain A or domain B, User ID label shows "NT AUTHORITY/NETWORK SERVICE", nothing listed as groups I belong to (since I am now apparently "NT Authority"), but group members for "TestGroup" are listed correctly. Accessing from PC in domain B pops up login dialog box, correctly.

If I remove the authorization section and leave identity section in web.config:

• I am not asked to login from PCs in either domain;
• Accessing from PC in domain A shows everything correctly
• Accessing from PC in domain B, shows user ID corrctly but no group membership and no users listed for "TestGroup" group.

It seems that in order to be able to show correct user ID, I need to have impersonate set to true; in order to require users to log in form a PC outside domain AI need to have authorization part, but both together don't seem to work from PCs outside domain A.

This is what I am using to get user ID, user group membership and group members:

WindowsIdentity wiUser = WindowsIdentity.GetCurrent();
string sID = wiUser.Name.ToUpper().Repl("DomainA\\", string.Empty);
string sGroupName = @"TestGroup";
List<string> lsGroups = Utils.GetUserADGroups(sID);
bool bTC = lsGroups.Contains(sGroupName);
StringCollection scGroupMembers = Utils.GetGroupMembers(Utils.DomainType., sGroupName);

static string adDomain = "USA.ABC.DEF.COM";
static string adContainer = "DC=USA,DC=abc,DC=def,DC=com";
static string adADPath = "LDAP://USA.abc.def.com";

public static List<string> GetUserADGroups(string UserName)
{
    List<string> lsGroups = new List<string>();

    try
    {
        PrincipalContext pc = new PrincipalContext(ContextType.Domain, adDomain, adContainer);
        UserPrincipal up = UserPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, UserName);
        PrincipalSearchResult<Principal> psr = up.GetGroups(pc);

        foreach (Principal p in psr)
        {
            lsGroups.Add(p.Name);
        }
    }
    catch (Exception)
    {
    }
    return lsGroups;
}

public static StringCollection GetGroupMembers(DomainType eDomainType, string strGroup)
{
    DirectoryEntry de = new DirectoryEntry(adDSADPath);
    System.Collections.Specialized.StringCollection GroupMembers = new System.Collections.Specialized.StringCollection();

    try
    {
        //DirectoryEntry DirectoryRoot = new DirectoryEntry(sADPath);
        DirectorySearcher DirectorySearch = new DirectorySearcher(de, ("(CN=" + (strGroup + ")")));
        SearchResultCollection DirectorySearchCollection = DirectorySearch.FindAll();

        foreach (SearchResult DirectorySearchResult in DirectorySearchCollection)
        {
            ResultPropertyCollection ResultPropertyCollection = DirectorySearchResult.Properties;

            foreach (string GroupMemberDN in ResultPropertyCollection["member"])
            {
                DirectoryEntry DirectoryMember = new DirectoryEntry(("LDAP://" + GroupMemberDN));
                System.DirectoryServices.PropertyCollection DirectoryMemberProperties = DirectoryMember.Properties;
                object DirectoryItem = DirectoryMemberProperties["sAMAccountName"].Value;

                if (null != DirectoryItem)
                {
                    GroupMembers.Add(DirectoryItem.ToString());
                }
            }
        }
    }
    catch (Exception ex)
    {
    }
    return GroupMembers;
}

I also tried to use this to see if user is a member of the group but it throws error if I access the site from PC in domain B:

public static bool IsMember(string UserName, string GroupName)
{
    try
    {
        PrincipalContext pc = new PrincipalContext(ContextType.Domain, adDomain, adContainer);
        UserPrincipal up = UserPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, UserName);
        PrincipalSearchResult<Principal> psr = up.GetGroups(pc);

        foreach (Principal result in psr)
        {
            if (string.Compare(result.Name, GroupName, true) == 0)
                return true;
        }
        return false;
    }
    catch (Exception e)
    { 
        throw e; 
    }
}

Answer 1

What ended up solving my problem was wrapping the functionality in the methods in:

using (System.Web.Hosting.HostingEnvironment.Impersonate())
{
}

For example, I change the method in my original post from:

public static StringCollection GetGroupMembers(DomainType eDomainType, string strGroup)
{
    DirectoryEntry de = new DirectoryEntry(adDSADPath);
    System.Collections.Specialized.StringCollection GroupMembers = new System.Collections.Specialized.StringCollection();
...
}

to:

public static StringCollection GetGroupMembers(DomainType eDomainType, string strGroup)
{
    using (System.Web.Hosting.HostingEnvironment.Impersonate())
    {
        DirectoryEntry de = new DirectoryEntry(adDSADPath);
        System.Collections.Specialized.StringCollection GroupMembers = new System.Collections.Specialized.StringCollection();
        ...
    }
}

Hope this saves someone else some grief as it caused me a lot!