如何在 dotnetcore 中对不属于域用户的用户进行身份验证？

Question

For security and management reasons, we are creating user entries in a separate container, adding them to a separate group, making that group primary, and then removing them from the Domain Users group. I have these steps all working, but now I can't find a way to authenticate them. I don't know if it's the classes I'm using or my arguments, or what.

Assuming:

AD_server = fully.qualified.domain
container = OU=My Users,OU=Accounts,DC=fully,DC=qualified,DC=domain
group = CN=App Users,OU=Software,DC=fully,DC=qualified,DC=domain
user = CN=Example,OU=Software,DC=fully,DC=qualified,DC=domain
sAMAccountName = Example
userPrincipalName = Example@MyUsers.fully.qualified.domain

I've tried

new LdapConnection(
  new LdapDirectoryIdentifier(AD_server)
).Bind(
  new NetworkCredential(userPrincipalName,password)
)

new LdapConnection(
  new LdapDirectoryIdentifier(AD_server)
).Bind(
  new NetworkCredential(sAMAccountName,password)
)

new DirectoryEntry(
  "LDAP://"+AD_server+"/"+container,
  sAMAccountName,
  password
)

new DirectoryEntry(
  "LDAP://"+AD_server+"/"+container,
  userPrincipalName ,
  password
)

new DirectoryEntry(
  "LDAP://"+AD_server+"/"+group,
  sAMAccountName,
  password
)

new DirectoryEntry(
  "LDAP://"+AD_server+"/"+group,
  userPrincipalName ,
  password
)

new DirectoryEntry(
  "LDAP://"+AD_server+"/"+group,
  user,
  password
)

I've also tried using the PrincipalContext.ValidateCredentials() method without success.

During creation:

this.principalContext = new PrincipalContext(ContextType.Domain,
  AD_server, // serves as domain and AD server
  container,
  adminUser,
  adminPassword);

The admin credentials have permissions to make changes to the domain. To create a user (starts with a transfer object):

UserPrincipal userPrincipal =
    UserPrincipal.FindByIdentity(principalContext, user.UserId + upnSuffix);
if (null == userPrincipal)
{
    userPrincipal = new UserPrincipal(principalContext)
    {
        SamAccountName = user.UserId,
        DisplayName = user.FullName,
        GivenName = user.FirstName,
        Surname = user.LastName,
        EmailAddress = user.Email,
        UserPrincipalName = user.UserId + upnSuffix,
        PasswordNeverExpires = true
    };
    //create user
    userPrincipal.Save();
}
return userPrincipal;

Set password: userPrincipal.SetPassword(password);

Answer 1

If you want to make extra sure that your authentication code is not the problem (I suspect it's not), you can try authenticating directly in Windows - either log into Windows with that account, or use runas at the command line:

runas /user:DOMAIN\username cmd

I suspect you'll have the same problem, which would mean there is an issue with the way the account is being created. I haven't created accounts with UserPrincipal (I have with DirectoryEntry ), but I noticed a difference between what you're doing (creating the account and then setting the password) and other examples online. You can try either:

1. Move userPrincipal.SetPassword(password) to before userPrincipal.Save() , or
2. Use the constructor that accepts the password so that it sets the password while creating the account:

userPrincipal = new UserPrincipal(principalContext, user.UserId, password, true)
{
    DisplayName = user.FullName,
    GivenName = user.FirstName,
    Surname = user.LastName,
    EmailAddress = user.Email,
    UserPrincipalName = user.UserId + upnSuffix,
    PasswordNeverExpires = true
};
//create user
userPrincipal.Save();

See if that makes any difference.