通过集成管道模拟域用户 [英] Impersonate Domain User with Integrated Pipeline
问题描述
在本地Intranet环境中，如果我们要使用模拟" Windows域用户，或者是否有一种新的方式来声明运行为"用户，那么我们注定要在我们的应用程序池中使用经典"管道模式吗?说话)?
In an local Intranet environment, are we doomed to use "Classic" pipeline mode in our App Pool if we want to use Impersonate our Windows domain users, or is there a new way to declaratively "run as" them (so-to-speak)?
我的目标是对Intranet上的本地Web应用程序使用Windows身份验证，以便用户可以使用其活动目录帐户(原理)对应用程序进行身份验证和运行.每次尝试此操作(当然使用NetworkService身份)，都会出现此错误:
My goal is to use Windows Authentication for local web applications on my Intranet so users can authenticate and run apps under their active directory account (principle). Every time I try this (Using the NetworkService identity of course), I get this error:
推荐答案
我编写了一个小应用程序来显示从多个不同位置(例如Page.User.Identity.Name)获取的当前用户的网络用户名.我还使用几种不同的查询Active Directory的方法来获取有关域用户的信息.所有这些都可以验证以下内容.
I wrote a small app to display the current user's network username grabbed from several different places such as Page.User.Identity.Name. I also grabbed information about the domain user using a couple different methods for querying Active Directory. All this to validate the following.
根据我的研究，我发现了使用Windows身份验证运行应用程序的两种主要模式，该模式主要用于Intranet环境中.以下是配置中的基本要素:
I have found two primary modes for running your application using Windows Authentication, which is primarily used in an Intranet environment according to my research. Here are the minimum essential elements of the configurations:
经典模式
- AppPool-托管管道设置为经典模式.
- AppPool-身份设置为网络服务.
- 身份验证-禁用:匿名身份验证
- 身份验证-启用:ASP.NET模拟
- 身份验证-启用:Windows身份验证
- 提供者-禁用:Kerberos
- 高级设置-内核模式:任意一个
集成模式
- AppPool-托管管道设置为集成模式.
- AppPool-身份设置为网络服务.
- 身份验证-禁用:匿名身份验证
- 身份验证-禁用:ASP.NET模拟
- 身份验证-启用:Windows身份验证
- 提供者-已启用:Kerberos
- 高级设置-内核模式:已禁用
现在是踢球！！
如果要使用集成模式(这是理想的选择，因为它可以产生更多的功能，并且可以集成)，则需要启用委派.以下是一些必读的文章，以了解委派的基础，并通过扩展动态SPN注册.由于这涉及到您可能需要探究的更多Kerberos和安全性考虑因素，因此坚持经典模式可能会更容易，在经典模式下，您要做的就是启用模拟并每天进行；否则作弊并禁用validateIntegratedModeConfiguration.
If you want to use Integrated mode (which is ideal as it yields much more functionality, and well, integration) you will need to have enabled Delegation. Here are a couple must-read articles to understand the basics of Delegation, and by extension Dynamic SPN Registration. Since this gets into more Kerberos and security considerations that you probably care to delve into, it might be easier to just stick with Classic mode where all you have to do is enable Impersonation and call it a day; or else cheat and disable validateIntegratedModeConfiguration.
这篇关于通过集成管道模拟域用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
