允許模擬用戶通過EWS托管API 2.0登錄到Exchange Server

Question

我在Windows Server 2016 IIS 10上托管了一個ASP .Net Application 。 Impersonation和Windows Authentication已啟用。

我希望已登錄的Active Directory用戶可以執行與其自己的郵箱相關的某些操作，而無需進行任何其他登錄（我的意思是不輸入用戶名/密碼）。

是否可以對Exchange Server ， Active Directory用戶和托管應用的服務器進行哪些配置更改？

我是如何使用EWS Managed API ：

using (var context = WindowsIdentity.GetCurrent().Impersonate())
{
    string mailbox = "user@domain.com"
    ExchangeService service = new ExchangeService();
    service.AutodiscoverUrl(mailbox);
    service.Url = new Uri(serverAddress);
    service.UseDefaultCredentials = true;
    service.Credentials = CredentialCache.DefaultNetworkCredentials;
    var rootFolder = Folder.Bind(service, new FolderId(WellKnownFolderName.MsgFolderRoot, mailbox));
}

在那種情況下，使用AutodiscoverUrl會出錯： The Autodiscover service couldn't be located. 當我嘗試避免AutodiscoverUrl ，如下所示：

using (var context = WindowsIdentity.GetCurrent().Impersonate())
{
    string serverAddress = "https://domain.com/EWS/Exchange.asmx";
    string mailbox = "user@domain.com"
    ExchangeService service = new ExchangeService();
    service.Url = new Uri(serverAddress);
    service.UseDefaultCredentials = true;
    service.Credentials = CredentialCache.DefaultNetworkCredentials;
    var rootFolder = Folder.Bind(service, new FolderId(WellKnownFolderName.MsgFolderRoot, mailbox));
}

我也遇到錯誤： The request failed. The remote server returned an error: (401) Unauthorized. The request failed. The remote server returned an error: (401) Unauthorized.

您能否建議如何配置這些服務器以使其相互通信？

Answer 1

您需要允許Kerberos代表團查看https://blogs.msdn.microsoft.com/emeamsgdev/2012/11/05/ews-from-a-web-application-using-windows-authentication-and-impersonation/其中有一個樣本並說明了需要做什么。