按需远程验证客户端 Windows 用户
假设我正在为特定的网络协议编写服务器。如果我知道客户端正在 Windows 计算机上运行，我的服务器是否可以对拥有独立于相关网络协议启动连接的客户端进程的 Windows 用户进行身份验证？
基本原理
我实际上想编写一个 FTP 代理服务器。客户端将使用所需的服务器用户名和虚假密码连接到代理。然后，代理将验证运行 FTP 客户端的 Windows 用户（通过 FTP 协议之外的某种机制）。对 Windows 用户进行身份验证后，代理将确定该 Windows 用户是否可以使用他们通过 FTP 客户端提供的用户名连接到真实的 FTP 服务器。
条件
- 客户端和代理将位于同一防火墙内，并且客户端不会隐藏在 NAT 后面（如果需要，允许代理连接回客户端）。
Suppose I am writing a server for a particular network protocol. If I know that the client is running on a Windows machine, is it possible for my server to authenticate the Windows user that owns the client process that initiated the connection independently of the network protocol in question?
Rationale
I actually wish to write an FTP proxy server. Clients would connect to the proxy with their desired server user name and a bogus password. The proxy would then authenticate the Windows user that is running the FTP client (via some mechanism apart from the FTP protocol). After authenticating the Windows user, the proxy would then determine if that Windows user may connect to the real FTP server as the user name they provided via their FTP client.
Conditions
- Both the clients and the proxy will be within the same firewall and no client will be hidden behind NAT (allowing the proxy to connect back to the client if necessary).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
微软试图让这变得困难。他们不希望程序在没有凭据的情况下进行身份验证。
您必须插入身份验证框架并让系统相信您确实是身份验证的来源。请参阅“Lsa”函数。
请参阅开源 ssh 服务器的源代码以了解您的选择。
当然，如果你真的有凭据，你可以合法地插入框架。
如果连接的另一端是 Windows 机器，您可以通过 Kerberos 获取凭据传输并使用 SSPI API。我推荐这本书。
Microsoft tries to make this difficult. They do not want programs to authenticate without credentials.
You have to plug into the authentication framework and convince the system that you really are a source of authentication. See the 'Lsa' functions.
See the source of an open source ssh server to get an idea of your options here.
Of course, if you really have credentials, you can be plugged into the framework legitimately.
If the other end of the connection is a Windows box, you can get credentials transferred across via Kerberos and use the SSPI API. I recommend this book.