“身份登录其他用户的MVC 4的Windows身份验证 [英] 'Login as another user' MVC 4 Windows Authentication

问题描述

我已经写在MVC 4的内部网项目，该项目使用Windows身份验证，授权和验证用户。

我需要添加一个身份登录其他用户的功​​能。

在一些搜索，我发现<一个href=\"http://bytes.com/topic/asp-net/answers/874302-changing-user-when-using-windows-authentication\">this解决方案这表明返回401，创造了以下行动（这就是所谓的用一种形式）：

  //
    // POST：/主页/注销    [HttpPost]
    [ValidateAntiForgeryToken]
    公众的ActionResult退出（）
    {
        返回新HttpUnauthorizedResult（）;
    }
 

该行动被调用，浏览器弹出一个用户名和密码的窗口，但作为结果重定向回行动，始终返回一个401。

我如何将用户重定向回previous行动，一旦他们与新的凭据登录？

有没有一种方法无效在服务器端的凭据，而不是只返回一个401？

解决方案

人们的逆向工程\\反编译从SharePoint一些code，恰好拥有这一功能。

我在 ASP.NET MVC 5 应用程序测试，它的工作正常。

  

在code是基于反编译的
  Microsoft.TeamFoundation.WebAccess其中有登录为
  不同的用户的功能。

 公众的ActionResult退出（）
{
    的HttpCookie饼干= Request.Cookies时[TSWA，最后用户];    如果（User.Identity.IsAuthenticated == ||假饼干== NULL || StringComparer.OrdinalIgnoreCase.Equals（User.Identity.Name，cookie.Value））
    {
        字符串名称=的String.Empty;        如果（Request.IsAuthenticated）
        {
            名称= User.Identity.Name;
        }        饼干=新的HttpCookie（TSWA-最后用户，名）;
        Response.Cookies.Set（饼干）;        Response.AppendHeader（连接，关闭）;
        Response.Status code = 401; //未经授权;
        Response.Clear（）;
        //或许应该做一个重定向这里擅自/失败的登录页面
        //如果你知道如何做到这一点，请点击它下面的评论
        的Response.Write（未经授权的重新加载页面再试一次......）;
        到Response.End（）;        返回RedirectToAction（「指数」）;
    }    饼干=新的HttpCookie（TSWA-最后用户的String.Empty）
    {
        过期= DateTime.Now.AddYears（-5）
    };    Response.Cookies.Set（饼干）;    返回RedirectToAction（「指数」）;}
 

---

来源：

强制登录为不同的用户同时使用Windows身份验证在asp.net

I have an intranet project written in MVC 4 which uses Windows Authentication to authorise and authenticate users.

I need to add a 'Login as another user' functionality.

After some searching I found this solution which suggests returning a 401, and created the following Action (which is called using a form):

    // 
    // POST: /Home/LogOut

    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOut()
    {
        return new HttpUnauthorizedResult();
    }

The Action gets called, and the browser pops up a username and password window, however as the result redirects back to the Action, a 401 is always returned.

How do I redirect the user back to the previous action, once they have logged in with the new credentials?

Is there a way to invalidate the credentials on the server side instead of just returning a 401?

解决方案

People reverse engineered\decompiled some code from Sharepoint that happens to have this feature.

I tested it in an ASP.NET MVC 5 app and it's working as expected.

The code is based on decompiling the Microsoft.TeamFoundation.WebAccess which has the "Sign in as a different User" function.

public ActionResult LogOut()
{
    HttpCookie cookie = Request.Cookies["TSWA-Last-User"];

    if(User.Identity.IsAuthenticated == false || cookie == null || StringComparer.OrdinalIgnoreCase.Equals(User.Identity.Name, cookie.Value))
    {
        string name = string.Empty;

        if(Request.IsAuthenticated)
        {
            name = User.Identity.Name;
        }

        cookie = new HttpCookie("TSWA-Last-User", name);
        Response.Cookies.Set(cookie);

        Response.AppendHeader("Connection", "close");
        Response.StatusCode = 401; // Unauthorized;
        Response.Clear();
        //should probably do a redirect here to the unauthorized/failed login page
        //if you know how to do this, please tap it on the comments below
        Response.Write("Unauthorized. Reload the page to try again...");
        Response.End();

        return RedirectToAction("Index");
    }

    cookie = new HttpCookie("TSWA-Last-User", string.Empty)
    {
        Expires = DateTime.Now.AddYears(-5)
    };

    Response.Cookies.Set(cookie);

    return RedirectToAction("Index");

}

---

Source:

Force Sign in as a different user while using Windows Authentication in asp.net

这篇关于“身份登录其他用户的MVC 4的Windows身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！