浏览器可以模拟 .hta 文件的安全相关功能吗？
目前，我们有一个 .hta 文件，员工用它来更新其活动目录配置文件的某些元素。这使系统管理员不必处理该问题。 .hta 文件的原因是显而易见的。它解除了许多现有的安全封锁，并允许机器执行其他方式无法执行的操作（例如更新活动目录配置文件）（据我所知）。
我意识到安全隐患，但我们被要求将此 .hta 应用程序转移到基于浏览器的 .net 应用程序。这可能吗？如果是的话，为什么可能？这对于浏览器来说似乎是（而且应该是）相对不可能的事情。
Currently, we have an .hta file that employees use to update certain elements of their active directory profile. This alleviates system administrators from having to deal with that issue. The reasoning for a .hta file is obvious. It lifts a lot of the security blockades in place and allows a machine to do things (such as update an active directory profile) that it otherwise wouldn't be able to do (to my knowledge).
I realize the security implications, but we are being asked to transfer this .hta application to a browser-based .net application. Is this even possible? If it is, why is it possible? It seems like something that is (and should be) relatively impossible from the browser.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我想这取决于您所说的基于浏览器的 .net 应用程序的含义。我编写了许多实用程序，这些实用程序以网页形式呈现给用户并更新 AD（或其他一些存储库）。在这些情况下，应用程序的至少一部分在服务器上运行。浏览器中的网页仅提供对此服务器代码的访问。
这背后有多种技术。我假设您的用户自己运行 .hta。您可以使用 ASP.NET 执行类似的操作。 ASP.NET 在 IIS 上运行。如果您使用 IE 作为浏览器，则可以将 IIS（和 IE）配置为使用 Windows 集成身份验证。这意味着 IE 将 Windows 安全令牌传递给 IIS，以便 IIS 知道用户是谁以及他们最近已向 DC 验证了自己的身份。 IIS 将其传递给 ASP.NET，以便您的应用程序也能知道这一点。您可以配置您的应用程序，使其“模拟”用户并使用其 ID 执行操作。
或者，您可以定义应用程序使用的凭据，并使用 IIS 应用程序池运行 ASP.NET 站点，或者在调用 AD 时直接在代码中使用凭据。当我希望用户能够执行他们无法使用自己的凭据执行的操作并且我不想通过将该权限委托给他们来授予他们直接访问权限时，我就这样做了。这意味着我可以向流程添加验证。
您使用名为 System.DirectoryServices（又名 S.DS）的 .NET 命名空间（或 System.DirectoryServices.Protocols（又名 SDS.P），但这更难使用，或 .NET 3.5 附带的 System.DirectoryServices.AccountManagement）并且您可以使用它读取和更新 AD。
如果您想了解更多信息，请更新您的问题，我会尽力提供帮助。
I guess it depends on what you mean by browser-based .net application. I've written many utilities which are presented to the user as web pages and which update AD (or some other repository). In these cases, at least a part of the application runs on the server. The web page in the browser merely gives access to this server code.
There are several technologies behind this. I'm assuming that your users run the .hta as themselves. You can do something similar using ASP.NET. ASP.NET runs on IIS. If you're using IE as your browser, you can configure IIS (and IE) to use Windows Integrated Authentication. This means that IE passes the windows security token to IIS so that IIS knows who the user is and that they've authenticated themselves to a DC recently. IIS passes this to ASP.NET so your application can know this as well. You can configure your app so that it 'impersonates' the user and does things using their ID.
Or, you can define credentials to be used by your app and either run the ASP.NET site using an IIS ApplicationPool or use the credentials directly in your code when you call out to AD. I've done this when I wanted the user to be able to do something they can't do with their own credentials and I've not wanted to grant them direct access by delegating that authority to them. It means I can add validation to the process.
You use a .NET namespace called System.DirectoryServices, aka S.DS, (or System.DirectoryServices.Protocols (aka SDS.P) but this is harder to use, or System.DirectoryServices.AccountManagement which came with .NET 3.5) and you can read and update AD using it.
If you want to know more, update your question and I'll try to help.