如何为我的 Web 应用程序构建 LDAP 集成？
我的公司开发并销售一个拥有数百名客户的 SaaS 应用程序。 我们的一些客户要求我们支持 LDAP 集成，以便根据他们现有的系统验证用户帐户，而不必为每个员工创建另一个登录帐户。 似乎这在很多地方都被称为单点登录 (SSO)？ 当然，我们的系统已经有一个机制来维护用户帐户配置文件并从我们的登录页面验证这些用户帐户。
我们对 LDAP 有点无知，并且对一些事情感到困惑。 请原谅可能使用错误的术语（请记住，我们对此有点无知）。
我们认为我们了解其工作原理的基础知识：
- 我们的客户配置其帐户以“打开”其帐户的“远程身份验证”功能。 他们提供将验证其用户身份的远程 URL。
- 用户来到我们的登录页面并尝试使用其公司的 LDAP 系统提供的用户名和密码登录。
- 我们的登录页面将安全地将登录凭据（可能以某种商定的格式加密和散列）转发到我们客户提供的“远程身份验证”URL。
- 客户的脚本将对用户进行身份验证，然后将他们重定向回我们的带有“身份验证状态”的网站。
- 我们的页面将分析“身份验证状态”并接受用户登录或未登录。
假设上述信息是半正确的，我们仍然需要每个用户在我们的系统中拥有一个帐户。 我们是否需要某种方法来将我们的用户帐户配置文件与 LDAP 目录中的用户配置文件同步？ 这只是一个引用 LDAP 系统中用户 ID 的“外部 ID”吗？ 那么是否需要客户的“远程身份验证”脚本必须向我们的系统提供该 ID，以便我们知道系统中的哪个用户帐户与登录关联？
我们缺少什么？
顺便说一句，我们的平台是 IIS、ASP.Net 2.0 和 SQL Server 2005。
My company develops and sells a SaaS application that has hundreds of customers. Some of our customers have asked us to support LDAP integration for authenticating user accounts against their existing systems instead of having to create another login account for each of their employees. Seems like this is referred to as Single Sign On (SSO) in many places? Naturally our system already has a mechanism for maintaining user account profiles and authenticating those user accounts from our login page.
We're a bit ignorant about LDAP and are confused about a few things. Please excuse the possible use of wrong terminology (remember, we're a little ignorant about this).
We think we understand the basics of how this might work:
- Our customer configures their account to "turn on" the "remote authentication" feature for their account. They provide the remote URL that will authenticate their users.
- Users come to our login page and attempt a login using their username and password provided by their company's LDAP system.
- Our login page will securely forward the login credentials (presumably encrypted and hashed in some agreed upon format) to the "remote authentication" URL provided by our customer.
- The customer's script will authenticate the user and then redirect them back to our site with the "authentication status".
- Our page will analyze the "authentication status" and either accept the user as logged in or not.
Assuming the above information is even semi-correct, we'll still need each user to have an account in our system. Won't we need some way to synchronize our user account profiles with the user profiles in the LDAP directory? Is this simply an "external ID" that references the user's ID in the LDAP system? Would it then be required that the customer's "remote authentication" script must provide that ID to our system so we know which user account in our system to associate the login with?
What are we missing?
BTW, our platform is IIS, ASP.Net 2.0, and SQL Server 2005.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
有几种选择。 如果您真正指的是 LDAP，而不仅仅是 Active Directory，我可能会考虑使用 System.DirectoryServices.Protocols 通过安全通道使用提供的凭据来执行 LDAP 绑定。
严格来说，这不是单点登录。 SSO 意味着您只需在首次登录时提交一次信用信息。 这只是通过仅使用一个 ID 来降低用户的复杂性。 通常，对于混合平台和技术的企业环境中的 Windows 客户端，SSO 是通过添加到桌面的客户端来实现的，该客户端管理对各种系统的身份验证。 在仅限 MS 的环境中，如果您的所有 Web 应用程序都位于 IIS 上，您使用 IE 并使用集成 Windows 身份验证、模拟和所有这些内容，则您可能会实现 SSO。
您可以考虑将经过身份验证的用户自动注册到您的系统中，除非您需要预先配置配置文件类型数据。 如果您确实需要预先配置用户，您可以考虑定期从 LDAP 目录导入（全部或过滤的子集）用户，并使它们处于未配置状态，以便管理员从现有的未配置列表中进行选择- 配置用户而不是输入 ID。 否则，您的管理员可能会面临输入错误用户 ID 并导致不匹配的风险。
您可以提供一个 API，以便身份和访问管理解决方案（考虑到您的 Microsoft 倾向，请参阅 ILM2 007 作为一个示例）可以与您的系统集成并为您执行所有用户帐户管理。
There are several options. If you really mean LDAP, as opposed to just Active Directory, I would probably look at using System.DirectoryServices.Protocols to perform an LDAP bind using the supplied credentials via a secure channel.
Strictly, this isn't Single Sign-On. SSO means only having to submit your creds once when you first log on. This is simply reducing complexity for the users by only having a single ID. Usually, for Windows clients in an enterprise environment with a mixture of platforms and technologies, SSO is achieved by a client added to the desktop which manages authentication to various systems. In an MS-only environment, you might achieve SSO if all of your web apps are on IIS, you use IE and use Integrated Windows Authentication, impersonation and all of that stuff.
You could consider auto-enrolling an authenticated user into your system, unless you require profile-type data to be preconfigured. If you do require pre-configuration of users, you could consider regularly importing (all, or a filtered subset of) users from the LDAP directory and having them in a not-configured state, such that the admins select from an existing list of not-configured users rather than typing in IDs. Otherwise, you risk your admins typing in the wrong user ID and having mismatches.
You could provide an API such that Identity and Access Management solutions (given your Microsoft slant, see ILM2 007 as one example) can integrate with your system and do all of the user account management for you.
一如既往，请记住验证身份验证测试，以确保发送的密码不为空。
根据标准，具有用户名且没有密码的绑定被视为匿名绑定，并且看起来已经成功！ 事实上，它确实没有。
这是应用程序需要处理的问题，因为 LDAP 服务器只是遵循标准，这是一个令人讨厌的标准，但仍然是一个标准。
As always remember to validate the authentication test to be sure that the password sent is not blank.
A bind with a user name and no password is considered an Anonymous bind, according to the standard, and looks like it has succeeded! When in fact, it really did not.
This is an issue for the application to handle, since the LDAP server is just following the standard, an annoying standard, but a standard nonetheless.
也许考虑身份验证与授权身份
验证 - 这是哪个用户？
授权 - 谁应该能够使用该应用程序、指定的用户、组？
目前，您暗示通过身份验证进行授权，因为只有那些注册到您的应用程序的人才被允许使用它。
如果您使用目录而不是自定义数据存储，然后
如果您的用户确实想要通用 LDAP，那么您需要查看 (C)
ldap_connect, ldap_bind_s(C#)LDAPConnection System.DirectoryServices.Protocols或者再次回到 AD < a href="http://channel9.msdn.com/posts/donovanf/Demystified-Series-WinForms-App-Single-Sign-On-in-2-Lines-of-Code/" rel="nofollow noreferrer">揭秘 .Net 应用单点登录可能会有所帮助
Perhaps consider Authentication Vs Authorisation
Authentication - which user is this?
Authorisation - who should be able to use the application, specified users, groups?
Currently you are implying authorisation through authentication because only those who are registered to your app are allowed to use it.
If you use a directory instead of your custom datastore then
If your users really want generic LDAP, then you want to look into (C)
ldap_connect, ldap_bind_s(C#)LDAPConnection System.DirectoryServices.ProtocolsOr again back to AD this Demystified .Net App single sign on might help
您需要决定计划如何将 LDAP 用户链接到应用程序中的帐户。
例如，您可能要求 LDAP 系统中的用户名与应用程序中的用户名匹配，或者您可能要求某人在应用程序的每个用户帐户中显式指定 LDAP 用户名。
一旦找到该链接，您就可以简单地执行 LDAP 绑定来测试用户凭据。
You need to decide how you plan to link an LDAP user to an account within your application.
For example, you could require that the username within the LDAP system match the username within your app, or you could require that someone explicitly specify an LDAP username within each user account in your app.
Once you've got that link figured out, you can simply execute an LDAP bind to test user credentials.
这在我们的系统中是这样工作的：
这样用户就可以重用他们的窗口我们的应用程序内的域身份验证。
The way this works in our system:
This way the user can reuse their windows domain authentication inside our app.
这是一款有用的软件，允许使用 JSON-RPC 通过网络访问 LDAP 目录： Json2Ldap
Here is one useful bit of software that allows LDAP directories to be accessed over the web, using JSON-RPC: Json2Ldap