在Classic Cloud Services中可以使用ActiveDirectoryMembershipProvider，但不能在Azure Web App上使用

Question

我们在.NET 4.7.2上有一个正常工作的ASP.Net Web应用程序（.NET Framework不是Core），已将其部署到传统的云服务中。 我们正在尝试将其部署到Azure应用服务。 到目前为止，大多数现有功能都运行良好。 不幸的是，我们在使ActiveDirectoryMembershipProvider作为FormsAuthentication工作的一部分方面遇到了麻烦。

我们的LDAP托管在AWS中，可通过IP地址访问。 出于调试目的，我们在不安全的LDAP（端口389）上尝试使用它。 我们可以从计算机访问LDAP，我们可以获取测试ldap用户的组成员身份。 但是，使用内置的ActiveDirectoryMembershipProvider，我们得到以下错误

Exception type  System.Configuration.ConfigurationErrorsException
Exception message   Access is denied.
 (D:\home\site\wwwroot\web.config line 242) <--- Access is denied.
System.Configuration.ConfigurationErrorsException: Access is denied.
 (D:\home\site\wwwroot\web.config line 242) ---> System.UnauthorizedAccessException: Access is denied.

   at System.DirectoryServices.ActiveDirectory.DirectoryContext.IsContextValid(DirectoryContext context, DirectoryContextType contextType)
   at System.DirectoryServices.ActiveDirectory.DirectoryContext.isDomain()
   at System.DirectoryServices.ActiveDirectory.Domain.GetDomain(DirectoryContext context)
   at System.Web.Security.DirectoryInformation.InitializeDomainAndForestName()
   at System.Web.Security.ActiveDirectoryMembershipProvider.Initialize(String name, NameValueCollection config)
   at System.Web.Configuration.ProvidersHelper.InstantiateProvider(ProviderSettings providerSettings, Type providerType)
   --- End of inner exception stack trace ---
   at System.Web.Configuration.ProvidersHelper.InstantiateProvider(ProviderSettings providerSettings, Type providerType)
   at System.Web.Configuration.ProvidersHelper.InstantiateProviders(ProviderSettingsCollection configProviders, ProviderCollection providers, Type providerType)
   at System.Web.Security.Membership.InitializeSettings(Boolean initializeGeneralSettings, RuntimeConfig appConfig, MembershipSection settings)
   at System.Web.Security.Membership.Initialize()
   at System.Web.Security.Membership.get_Provider()
   at System.Web.Security.Membership.ValidateUser(String username, String password)
   at <ASPX METHOD>:.ValidateUser(String username, String password) in <ASPX CODEBEHIND>:line 56
   at <ASPX METHOD>(Object sender, EventArgs e) in <ASPX CODEBEHIND>::line 26
   at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
   at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)
   at System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at ASP.<ASPX CODEBEHIND>:.ProcessRequest(HttpContext context) in d:\local\Temporary ASP.NET Files\root\0a1c09b7\daf71945\App_Web_ahzd2zi1.4.cs:line 0
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.<>c__DisplayClass285_0.<ExecuteStepImpl>b__0()
   at System.Web.HttpApplication.StepInvoker.Invoke(Action executionStep)
   at System.Web.HttpApplication.StepInvoker.<>c__DisplayClass4_0.<Invoke>b__0()
   at Microsoft.AspNet.TelemetryCorrelation.TelemetryCorrelationHttpModule.OnExecuteRequestStep(HttpContextBase context, Action step)
   at System.Web.HttpApplication.<>c__DisplayClass284_0.<OnExecuteRequestStep>b__0(Action nextStepAction)
   at System.Web.HttpApplication.StepInvoker.Invoke(Action executionStep)
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

成员资格配置如下

<membership defaultProvider="MyADMembershipProvider">
    <providers>
        <clear />
        <add name="MyADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName" connectionUsername="<DOMAIN>\<USERNAME>" connectionPassword="<PASSWORD>" />
    </providers>
</membership>

连接字符串是

<add name="ADConnectionString" connectionString="LDAP://<IPADDRESS>:<PORT>/DC=<DOMAIN>,DC=local" />

似乎找不到任何迹象表明在Azure中运行它有所不同。 任何见解均表示赞赏。

Answer 1

Azure App Services不适用于Active Directory。 您可能要探索Azure Active Directory。

LDAP无法直接在Cloud上运行。 您将必须使用Azure AD域服务-https://docs.microsoft.com/zh-cn/azure/active-directory-domain-services/configure-ldaps

此外，App服务是一个沙盒环境。