[英]Authenticate against a user in active directory?
我确实有一个Web应用程序,其中有一个登录页面。如何对活动目录用户进行身份验证?
到目前为止,我已经能够从活动目录中获取一些属性,这表明我能够使用LDAP字符串与AD通信。我知道无法从AD中提取密码并针对用户输入的密码进行身份验证!
有什么方法可以对活动目录用户进行身份验证吗?
到目前为止,这是我的代码
public class Userdetails
{
public static string ADPath = ConfigurationManager.AppSettings.Get(“ADPath”); // Get the ADAM Path from web config fiel
public static string ADUser = ConfigurationManager.AppSettings.Get(“ADUser”); //ADAM Administrator
public static string ADPassword = ConfigurationManager.AppSettings.Get(“ADPassword”); //ADAM Administrator password
public static DirectoryEntry GetUserDetails(string userID)
{
AuthenticationTypes AuthTypes; // Authentication flags.
// Set authentication flags.
// For non-secure connection, use LDAP port and
// ADS_USE_SIGNING |
// ADS_USE_SEALING |
// ADS_SECURE_AUTHENTICATION
// For secure connection, use SSL port and
// ADS_USE_SSL | ADS_SECURE_AUTHENTICATION
AuthTypes = AuthenticationTypes.Signing |
AuthenticationTypes.Sealing |
AuthenticationTypes.Secure;
DirectoryEntry De = new DirectoryEntry(ADPath, ADUser, ADPassword, AuthTypes);
DirectorySearcher Ds = new DirectorySearcher(De);
SearchResult Sr;
Ds.SearchScope = SearchScope.Subtree;
Ds.Filter = “(&(objectclass=*)(cn= ” + userID + “))”;
Sr = Ds.FindOne();
if (!(Sr == null))
{
De = new DirectoryEntry(Sr.Path, ADUser, ADPassword, AuthTypes);
return De;
}
else
{
return null;
}
}
http://msdn.microsoft.com/en-us/library/bb299745.aspx
http://msdn.microsoft.com/zh-CN/library/system.directoryservices.accountmanagement.aspx
http://msdn.microsoft.com/zh-CN/magazine/cc135979.aspx
public bool Validate(string username, string password)
{
//ex PrincipalContext principalContext = new PrincipalContext(ContextType.ApplicationDirectory,"sea-dc-02.fabrikam.com:50001","ou=ADAM Users,o=microsoft,c=us",ContextOptions.SecureSocketLayer | ContextOptions.SimpleBind,"CN=administrator,OU=ADAM Users,O=Microsoft,C=US","P@55w0rd0987");
try
{
using (PrincipalContext principalContext = new PrincipalContext(ContextType.Domain, Configuration.Config.ActiveDirectory.PrimaryServer, Configuration.Config.ActiveDirectory.Container, ContextOptions.Negotiate))
{
return principalContext.ValidateCredentials(username, password);
}
}
catch (PrincipalServerDownException)
{
Debug.WriteLine("PrimaryServer={0};Container={1}", Configuration.Config.ActiveDirectory.PrimaryServer, Configuration.Config.ActiveDirectory.Container);
Debug.WriteLine("LDAP://{0}/{1}", Configuration.Config.ActiveDirectory.PrimaryServer, Configuration.Config.ActiveDirectory.Container);
throw;
}
如果您仅要针对AD进行身份验证,而不必执行其他特定于AD的操作,为什么不坚持使用内置的ActiveDirectoryMembershipProvider
而不是编写自定义代码呢?
请看一下:
http://msdn.microsoft.com/zh-CN/library/system.web.security.activedirectorymembershipprovider.aspx
使用密码创建一个新的DirectoryEntry并将其与DirectorySearcher一起使用将验证密码并在密码失败时引发异常。 一个重要的例外是空/空密码。 如果LDAP参数为null或为空,则大多数LDAP服务器(我认为都包含AD)将忽略password参数。 因此,您应该首先进行测试。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.