我使用什么 Active Directory 字段来唯一标识用户？
我有一个通过 AD 进行身份验证的 Asp.net MVC 项目。我想将当前登录用户的审核信息存储在表中。我应该在数据库中存储什么？我目前正在使用 SamAccountName 作为我的会员资格和角色提供者。我应该使用这个吗？我应该使用更详细和现代的 UserPrincipalName< /a>?如果我们最终使用多个域怎么办？
Guid？ Guid 似乎是显而易见的选择，但我对此一无所知。为什么它可以为空？这个值会改变吗？它有什么用？
进行更新
...使用 SID 而不是 GUID 的原因是为了向后兼容。 Windows NT 使用 SID 来标识资源 ACL 中的用户和组。
如果您将用户移动到新域，SID 实际上会发生变化，GUID 将保留 持续的。在我看来，GUID 是可行的方法，除非您打算针对 NT4 AD 服务器进行身份验证。
我不知道在这里该怎么做，因为我两天都无法接受自己的答案。最深入的解释获胜？
I have an Asp.net MVC project authenticating through AD. I would like to store audit information in tables for the current logged in user. What should I be storing in the database? I am currently using SamAccountName for my membership and role providers. Should I be using this? Should I use the more verbose and modern UserPrincipalName? What if we eventually end up using multiple domains?
What about Guid? Guid would seem like the obvious choice but I know nothing about it. Why is it nullable? Does this value change? What is it used for?
Update
According to SID vs. GUID ...
The reason for using SIDs at all, and not GUIDs, is for backward compatibility. Windows NT uses SIDs to identify users and groups in ACLs on resources.
SIDs will actually change if you move a user to a new domain, the GUID will remain
constant. It looks to me like GUID is the way to go unless you intend to authenticate against a NT4 AD server.
I'm not sure what to do here as I cannot accept my own answer for 2 days. Most in-depth explanation wins?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
根据 SID 与 GUID ...
话虽这么说，我决定使用 GUID。如果您将用户移动到新域，SID 实际上会发生变化，GUID 将保持不变。只要您不打算在 NT4 AD 服务器上运行应用程序，GUID 就是您的最佳选择。
According to SID vs. GUID ...
That being said, I've decided to go with GUID. SIDs will actually change if you move a user to a new domain, the GUID will remain constant. So long as you don't plan on running your application against an NT4 AD server, GUID is the way to go.
您可能想要使用 SID——这是操作系统本身在大多数情况下使用的。 SID 在域或工作组中也是唯一的。
仅用户名的问题在于它可以更改，而 SID 是固定的。
You might want to use the SID -- that's what the OS itself uses in most cases. SIDs are also unique across domains or workgroups.
The problem with user name alone is that it can be changed, whereas the SID is fixed.
如果您将 ASP.NET MVC（或 Webforms）与 Windows 身份验证一起使用，为什么不直接使用从此属性获取的用户名：
这会返回用户的域/用户名。我曾开发过将其用于审计目的的企业网络应用程序。我很想知道您是否认为这对于您的目的来说不够独特。
另外，我不确定为什么您要存储用户的 SID 或 GUID，因为当您查看审核日志时，与域/用户相比，它很难读取。
If you are using ASP.NET MVC (or Webforms for that matter) with Windows Authentication, why not just use the user name that you get from this property:
This returns Domain/Username of the user. I have worked on corporate web apps that used this for auditing purposes. I would be curious to know if you think this is not unique enough for your purposes.
Also I'm not sure why you would want to store a SID or GUID of the user, as it is very hard to read compared to domain/user when you are viewing audit logs.
samAccountName 是用户用于登录的用户名。您也可以通过添加域名来获得更“完整”的效果，但没有理由不使用明显的用户名字段。
samAccountName is the user name the user uses to log in with. You can get a little more 'complete' by prepending the domain too, but there's no reason not to use the obvious username field.