将外部用户放入 Active Directory 是一种不好的做法吗？
我们有一个现有的 Web 应用程序，并且希望从自定义身份验证解决方案迁移到 Active Directory 联合身份验证服务，以便我们的合作伙伴组织可以管理其用户的授权。
目前，该站点正在使用自定义数据库表来管理用户，并使用自定义逻辑来管理身份验证和授权。
除了将验证其用户并通过 ADFS 获取访问权限的合作伙伴组织之外，我们还有位于 Active Directory 域中的内部用户。 这些用户还可以通过 ADFS 进行身份验证。
我们的问题围绕着我们的外部用户。 该网站还允许个人注册。 这些人没有为任何组织工作，因此我们无法使用 ADFS 来处理他们的身份验证。
由于我们需要支持这些人，因此我们需要管理他们的用户帐户。
ADFS 只能连接到 Active Directory 或 Active Directory 应用程序模式帐户存储。
由于 ADFS 仅支持这些帐户存储，因此逻辑解决方案似乎是在我们的 Active Directory 域中为外部用户创建帐户。
这意味着我们将更新注册页面以在活动 Active Directory 中创建新的用户帐户，而不是在自定义数据库中创建新记录。
那么，这是一种不好的做法吗？ AD 是否应该用于组织外部的用户？ 其他人在使用 ADFS 时如何处理这种情况？
We have an existing Web application and we want to migrate from a custom authentication solution to Active Directory Federation Services so that our partner organizations can manage the authorization of their users on their side.
Right now the site is using custom database tables to manage users and custom logic to manage authentication and authorization.
In addition to the partner organizations that will authenticate their users and gain access through ADFS, we have internal users who are in our Active Directory domain. These users can also be authenticated through ADFS.
Our question revolves around our external users. This site also allows individuals to register. These individuals don't have any organization for whom they work, so we can't use ADFS to handle their authentication.
Since we need to support these individuals, we need to manage their user accounts.
ADFS can only connect to Active Directory or Active Directory Application Mode account stores.
Since ADFS only supports these account stores, it seems like the logical solution is to create accounts for external users in our Active Directory domain.
This would mean that we'd update our registration pages to create new user accounts in active Active Directory rather than creating new records in our custom database.
So, is this a bad practice? Should AD be used for users external to one's organization? How do others handle this type of situation when using ADFS?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
为外部用户创建新的 AD 林，您可能需要设置一些更好的安全性，但可以将两者连接起来以进行无缝身份验证。
您需要告诉他们在登录时使用不同的域（例如，您的普通用户使用“mycorp”，外部用户使用“externalcorp”），但否则它是完全透明的。
Create a new AD forest for your external users, you might need to set up some better security, but the two can be conencted for seamless authentication.
You'll need to tell them to use a different domain when logging on (eg your normal users use 'mycorp', externals use 'externalcorp') but otherwise it's totally transparent.
是的，将外部用户与内部用户放在同一个 AD 中是不好的做法。 将外部帐户分开，并查看 ADAM 进行外部用户身份验证。
Yes, it is bad practice to put external users in the same AD as your internal users. Keep external accounts separate and check out ADAM for external user authentication.
我认为您需要问的问题不是将外部帐户存储在活动目录中是否不好，而是将帐户存储在与内部帐户相同的林中是否不好。 这是可以做到的，但我倾向于同意 Fallen 的观点，即我不会将外部帐户与内部帐户放在同一个林中。
过去，当我们使用 AD 存储来放置外部帐户时，我们创建了一个新林并将外部用户放置在其中，然后信任这两个域。 在我看来，这是更好的选择，因为用户对内部网络的最高访问权限受到信任而不是用户帐户的限制。 如果域被包含，您可以随时将其关闭，并且您会知道外部网络无法访问内部网络。 这还允许您在外部和内部用户之间拥有不同的安全策略。
I think the question you need to ask is not if storing external accounts in active directory is bad, but if storing accounts in the same forest as your internal accounts is bad. It, can be done, but I would tend to agree with Fallen that I wouldn't put the external accounts in the same forest with the internal ones.
In the past when we used an AD store to place external account we created a new forest and placed the external users in there and then trusted the two domain. In my opinion this is the better option because the highest access users have to the internal network is limited by the trust and not a user's account. If the domain is comprised you can always shut it down and you'll know that nothing with external can access the internal networks. This also allows you to have different security policies between external and internal users.