如何对一个站点上的用户进行身份验证并将凭据传递到另一站点？ （Windows 身份验证、ASP.Net）
我们有多个运行 Windows 身份验证的 Web 应用程序。
用户使用 Domain\Username 登录网站，这与他们在本地计算机上使用的 DomainOther\UsernameOther 不同。
考虑到我们有 2 个站点 One.xyz.com 和 Two.xyz.com 都运行 Windows 身份验证（并且用户使用域\用户名登录到这两个站点），是否可以将用户从 One.xyz.com 上的页面重定向到一旦他已经在 One.xyz.com 上输入了凭据，就可以访问 Two.xyz.com 的主页吗？
使用 ASP.Net 可以做到这一点吗？
亲切的问候，
We have multiple web-applications running Windows authentication.
Users log on to the websites using Domain\Username which is different from the DomainOther\UsernameOther that they use on their local computers.
Considering we have 2 sites One.xyz.com and Two.xyz.com both running Windows Authentication (and user logs in to both using Domain\Username), is it possible to have theuser redirect from a page on One.xyz.com to the homepage of Two.xyz.com without entering his credentials again once he has already entered them on One.xyz.com?
Is it possible to do this using ASP.Net?
Kind regards,
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您正在寻找的称为单点登录，并且有多种商业产品能够满足您的需求。 其中许多通过 HTTPS 上的服务器变量传递凭据，以便用户不会在 URL 中看到凭据。 我曾与那些想要“推出自己的”并且寻求其他方法（引用第三个服务器的会话密钥、加密且对时间敏感的 URL 字符串等）的公司合作过。
首先，您需要阅读有关单点登录的维基百科条目 （它也与 SAML 链接）。 您可能需要访问一些更受欢迎的商业供应商网站，例如 Passlogix< /a> 和 Imprivata （不过有几十个，所以不要将此列表视为详尽无遗）甚至特别推荐 - 只是受欢迎）。
What you are looking for is called Single Sign-On and there are a broad variety of commercial products capable of supporting your needs. Many of them pass credentials via server variables over HTTPS so that the users doesn't see the credentials in the URL. I've worked with companies that wanted to "roll their own" and who went for other approaches (session keys that reference a third server, encrypted and time-sensitive URL strings, etc.).
To get started, you'll want to read the Wikipedia entry on single sign-on (it links with SAML as well). You may want to visit some of the more popular commercial vendors' websites such as Passlogix and Imprivata as well (there are dozens, though, so don't take this list as exhaustive or even particularly recommended - just popular).
SharePoint 支持 SPNEGO 身份验证，这是一种单点登录形式。 MSDN 提供了有关使用 SPNEGO 在 .net 上进行单点登录的文档。 查看 Microsoft 安全 SSPI。 我通过快速搜索找到了此示例。
SPNEGO 是 Kerberos 的 Microsoft 变体，它将与 IBM 产品和 Oracle WebLogic 进行互操作，还有。
如果您希望使用比 Kerberos 具有更广泛互操作性的国际标准进行单点登录，则应使用 SAML。 有关 SAML 的 Microsoft 讨论，请参阅 Active Directory 联合。 然而，SAML 的实现和配置要复杂得多。
SharePoint supports SPNEGO authentication, a form of single sign-on. MSDN has documentation for using SPNEGO for single-sign on .net. Look at the Microsoft Security SSPI. I found this sample with a quick search.
SPNEGO is a Microsoft variation of Kerberos and it will interoperate with IBM products and Oracle WebLogic, as well.
If you want single-sign using an international standard that has wider interoperability than Kerberos, you should use SAML. See Active Directory Fedration for a Microsoft discussion of SAML. However, SAML is much more complicated to implement and configure.