我可以构建一个允许匿名访问但根据用户 ID 模拟用户权限的 .net Web 服务吗？
我在 IBM WAS 服务器 (Windows) 上有一个 Web 应用程序。
在 WAS 应用程序中，用户可以浏览不同服务器上的文件。 此功能连接到 Web 服务，以便从网络路径检索文件列表。
Web 服务是使用 .net 构建的，驻留在与文件服务器位于同一域中的单独服务器上。
WAS 应用服务请求将用户的 ID 作为调用的一部分发送。
有没有办法获取传递给 Web 服务的用户 ID，并根据 Windows 安全性限制该用户只能访问他们有权访问的文件/文件夹？
据我所知，除非 WAS 应用程序能够以登录用户的身份将请求发送到 Web 服务，否则这是不可能的。
那么，我的第二个问题是，是否可以将 Windows 用户凭据从 WAS 应用程序传递到 Web 服务？
我不太熟悉 Windows 身份验证和模拟，而且对 WAS 及其如何处理安全性知之甚少，因此我希望了解这是否可行以及可以从哪里开始。
I have a web application on an IBM WAS server (Windows).
In the WAS app users are able to browse files on a different server. This functionality connects to a web service in order to retrieve a listing of files from a network path.
The web service is built with .net and resides on a separate server which is in the same domain as the file server.
The WAS app service request sends the user's id as part of the call.
Is there a way to take the user's id that is passed to the web service and restrict that user to only the files/folders they have access to based on Windows Security?
From what I know this is not possible unless the WAS app is able to send the request to the web service as the logged in user.
So, my second question is, is it possible to pass Windows user credentials from a WAS application to a web service?
I'm not too familiar with Windows Authentication and impersonation and I know even less about WAS and how it handles security so I'm hoping to find out if this is possible and where I might get started.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
假设您有 Active Directory 设置，我能想到的 WAS 服务器发送访问它的用户凭据的唯一方法是 DC 识别 WAS 服务（即运行 WAS 应用程序的帐户）进行委派。 我们在这里（某种程度上）遇到了这个问题。 我们使用 AD 帐户来运行 IIS 应用程序池，然后该 AD 帐户需要能够根据 AD 验证用户并连接到 SQL Server。
我们的修复方法是为运行 IIS 应用程序池的用户注册服务进程名称 (SPN)。 这允许用户帐户根据 AD 对用户进行身份验证，因为 AD 会将其识别为服务。 然后，您可以遵循传统的 .NET 模拟规则来传递凭据。 很抱歉我无法提供更具体的信息，但我希望这至少能为您指明正确的方向。
请参阅：http://technet.microsoft.com/en-us/library/ cc773257.aspx
Assuming you have an Active Directory setup, the only way I can think of for the WAS server to send along the credentials of the user accessing it is if the DC recognizes the WAS service (I.E. the account running your WAS application) for delegation. We ran into this problem (somewhat) here. We use an AD account to run our IIS application pools, and then that AD account needs to be able to verify users against AD and connect to SQL server.
The fix for us was to register service process names (SPN's) for user running the IIS application pool. This allows the user account to authenticate users against AD since AD will recognize it as a service. Then you can follow traditional .NET impersonation rules to pass the credentials along. I'm sorry I can't provide more specific information, but I hope this at least points you in the right direction.
See: http://technet.microsoft.com/en-us/library/cc773257.aspx
以下是了解 .NET 的匿名访问和模拟的链接：匿名访问和模拟
Here is a link to understand Anonymous Access and Impersonation with .NET : Anonymous Access and Impersonation
不可以。您可以创建身份令牌，但为了进行访问检查，您需要一个模拟令牌，并且只能通过提供密码或通过受信任的委派帐户进行委派来创建此类令牌，而该帐户又提供了密码（或足够的密码）证明原始身份拥有密码，即 AD 为其担保）。
您需要做的是让 WAS 服务器模拟调用者，然后在模拟下调用您的服务。 运行 WAS 的帐户必须配置为允许约束委派。
No. You can create an identity token, but for access check you would need an impersonation token and such a token can only be created by presenting the password or by delegation from an account trusted for delegation that in turn was presented the password (or sufficient proof to trust that the original identity posses the password, ie. the AD vouched for him).
What you need to do is have the WAS server impersonate the caller and then call your service under impersonation. The account running WAS would have to be configured to allow constrained delegation.