无需身份验证即可访问 Sharepoint Web 服务
是否可以在无需身份验证的情况下访问 Sharepoint Web 服务？ 如果您不能直接这样做，您可以想出任何方法来绕过它，例如在中间提供一个开放服务，使用公共帐户为您进行身份验证。
Is it possible to access a sharepoint web service without authenication? If you can't do it directley can you think of any ways to get round it such as haveing an open service inbetween that does authenicate for you using a public account.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
John，
您尝试通过其访问相关 Web 服务的 Web 应用程序的安全模型将决定您是否可以匿名访问该服务。 如果您尝试通过启用了匿名访问的 Web 应用程序访问 Web 服务，那么您将能够访问该 Web 服务。 继续在匿名网站上尝试一下（如果您有的话）： http://yoursitehere/_vti_bin/lists.asmx 。 您将获得友好的服务页面，无需任何身份验证。
问题是：一旦您遍历了 Web 服务层，您就需要处理另一层安全性。 SharePoint 本身会像平常一样检查通过 Web 服务的访问权限，因此除非您尝试执行操作或尝试访问允许匿名用户的数据，否则您将被阻止。
您有多种选择：
只需确保您尝试做的所有事情都被允许匿名即可。 这听起来可能很简单，但实际上除了最简单直接的操作之外，其他任何事情都可能相当困难。 大多数组织也不关心将事情开放到这种程度。
如果您控制调用 Web 服务的代码，则您可以将凭据附加到 Web 服务请求。 我建议从这里开始，因为这会让事情变得比试图把所有事情都敞开心扉容易得多。 有大量有关将凭据附加到 Web 服务代理的示例（例如 http:// msdn.microsoft.com/en-us/security/cc178918.aspx)
最后，您可以编写自己的 Web 服务来包装感兴趣的 SharePoint Web 服务（或多个服务）。 您可以允许匿名访问您的 Web 服务，然后在您自己的服务中采用适当的安全上下文，以所需的权限级别访问 SharePoint。
我希望这有帮助！
John,
The security model of the web application through which you're trying to access the web service in question is going to drive whether or not you can access the service anonymously. If you're attempting to access the web service through a web application on which anonymous access is enabled, then you'll be able to hit the web service. Go ahead and try this on an anonymous site (if you have one): http://yoursitehere/_vti_bin/lists.asmx. You'll get the friendly service page back, no auth required.
Here's the catch: once you traverse the web service layer, you've got another layer of security to deal with. SharePoint itself is going to want to check permissions for access via the web services just as it normally would, so unless you are attempting an operation or trying to access data that is allowed for anonymous users, you're going to get blocked.
You have a handful of options:
Simply ensure that everything you're trying to do is permitted anonymously. This may sound easy, but it can actually be pretty difficult for anything but the simplest and straightforward of operations. Most organizations, too, don't care for opening things up to this extent.
If you control the code that's calling the web service, then you have the ability to attach credentials to the web service request. I recommend starting here, as it is going to make things a lot easier than trying to throw everything wide open. Plenty of examples exist on attaching credentials to a web service proxy (e.g., http://msdn.microsoft.com/en-us/security/cc178918.aspx)
Finally, you could write your own web service that wraps the SharePoint web service (or services) of interest. You could permit anonymous access to your web service and then adopt an appropriate security context within your own service to access SharePoint with the required permissions level.
I hope this helps!
我认为您不能，网络服务执行的大多数操作都需要具有正确权限集的显式用户。 如果两个站点都是内部站点，您的选项可能包括
使用自动 NTLM 身份验证，为整个经过身份验证的用户组提供必要的 acecss。 使用 IE 或 FireFox 的适当扩展凭据将自动传递，无需用户提示。 您的情况可能会有所不同。
在调用 Web 服务时将正确的凭据显式传递给默认用户
来自另一个网站。
如果您觉得有创意，这里是 Reza Alirezaei 的博客，他在其中逐步完成将匿名用户映射到特定帐户的步骤。 如果您设法授予该帐户适当的权限，那么您就可以了。 不过，不适合胆小的人。
I don't think you can, most actions the webservices perform need an explicit user with the correct permissions set. If both sites are internal, your options might include
Using automatic NTLM authentication, give the complete Authenticated Users group the necessary acecss. Using IE or the proper extensions to FireFox credentials will be automatically passed without user prompting. Your mileage may vary.
Passing the proper credentials to a default user explicitly in the call to the webservice
from that other website.
If you feel creative, here is a blog from Reza Alirezaei where he walks through the steps of mapping the anonymous user onto a specific account. If you manage to give that acount the proper permissions, you are there. Not for the faint of heart, though.