IIS 上的客户端证书 - 不确定我是否明白 - 有经验吗？
寻找一些有关使用客户端证书来改进现有应用程序的访问控制的建议。
我们公司有一个现有的 Intranet 应用程序（经典 ASP/IIS），我们将其授权给其他人。 到目前为止，它已托管在使用它的每个组织内，安全性包括“如果您能够访问内联网，您就能够访问应用程序”。
我现在正在寻找一种在外部托管此应用程序的方法，以便其他不想自己托管它的组织可以使用它（每个新客户端都有自己的安装）。
新组织中的所有用户都将拥有客户端证书，因此我想做的是使用 IIS 中的“需要客户端证书”内容。 它允许您说“如果 Organization=BigClientX，则假装他们是本地用户Y”。
我更喜欢的是“如果 Organization=BigClientX 那么让他们访问 virtualdirectoryZ 中的资源，否则忽略它们”。
我很乐意购买一个插件（也许是 ISAPI 过滤器？），如果这是最好的方法，它可以为我做到这一点。 欢迎任何建议/战争故事。
Looking for some advice about the use of client certs to retro-fit access control to an existing app.
Our company has an existing intranet app (classic ASP/IIS) which we licence to others. Up till now it's been hosted within each organisation that used it and the security consisted of "if you're able to access the intranet you're able the access the application".
I'm now looking for a way to host this app externally so that other organisations who don't wish to host it themselves can use it (each new client would have their own installation).
All user in the new organisation would have a client cert so what I'd like to do is use the 'Require Client Certificate' stuff in IIS. It allows you to say "if Organisation=BigClientX then pretend they're local userY".
What I would prefer is something that says "if Organisation=BigClientX then let them access resources in virtualdirectoryZ otherwise ignore them".
I would be very happy to buy an addon (perhaps an ISAPI filter ?) which would do this for me if that was the best approach. Any advice / war stories would be welcomed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可能想要这样做。 客户端证书实际上是用于身份验证的第二个因素，而不是主要来源。 换句话说，您仍然需要配置应用程序进行基本或表单身份验证。
公钥/私钥背后的技术坚如磐石。 但是，您需要一个非常成熟的 IT 组织来处理证书生命周期管理。 如果您没有这个，您将遇到无数的失败场景，因为证书已过期，未复制到新计算机等。
在您的应用程序面向互联网的场景中尤其如此（在“托管”场景中） ) - 您对向用户颁发证书几乎没有控制权。
You likely want to do this. client certs are really intended for a second factor of authentication, but not the primary source. To say it differently, you still need to configure your app for basic or forms authentication.
The technology behind public/private keys is rock solid. However, you need a very mature IT organization who is dealing with certificate lifecycle management. If you do not have this, you will get untold failure scenarios because the certificate was expired, wasn't copied to the new computer, etc.
This is especially true in your scenario where your application is internet facing (in thee 'hosted' scenario) - you have little control about the issuance of the certificates to your users.
我做过类似的事情...
从组织的域控制器内部生成证书。 将它们导出为 PFX 格式以供分发，以及 CER 格式以供导入到 IIS 中。
将 PFX 格式导出与 DC 的 CA 证书一起分发，以便您的客户计算机将“信任”您的 CA。
现在，在应用程序属性 IIS 中，转到目录安全选项卡，然后在“安全通信”下单击“编辑”。 在其中，单击“接受客户端证书”、“启用客户端证书映射”，然后单击“编辑”。
在“1对1”选项卡下，单击“添加”并导入CER文件。 输入您想要将此证书映射到的帐户。
至于“让他们访问资源”，我建议通过他们映射的用户帐户来实现这一点 - 也就是说，您可以通过 NTFS 权限或通过识别安全性的代码来提供对基于该帐户的资源的访问登录用户的上下文。
I've done something similar...
Generate the certificates internally from your org's domain controller. Export them both as PFX format for distribution, and CER format for you to import in IIS.
Distribute the PFX format exports along with the CA certificate for your DC, so your customers machines will "trust" your CA.
Now in the app properties IIS, go to the Directory Security tab, and under "Secure Communications" click "Edit". In there, click "Accept client certificates", "Enable Client Certificate Mapping", then "Edit".
Under the 1-to-1 tab, click "Add" and import the CER file. Enter the account you'd like to map this certificate to.
As for the "let them access resources" I'd advise doing that by the user account they're mapped through - that is, you can provide access to resources based on that account either through NTFS permissions, or through code by identifying the security context of the logged-in user.