ASP.NET - 针对多个域的身份验证
我的网站可以从许多域（我自己的博客引擎）访问。那么，我如何进行交叉身份验证？
我正在使用：IIS7、C#、asp.net 成员资格、表单身份验证。
My website can be access from many domain (a my own blog engine). So, how i can cross authentication?
I'm using: IIS7, C#, asp.net membership, form authentication.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您使用的是 Active Directory（假设这就是您所说的域），您只需配置多个
ActiveDirectoryMembershipProvider部分并使用asp:Login控制模板，添加一个您要对其进行身份验证的域的下拉菜单，并在登录控件的 OnAuthenticate 事件中设置选定的 AD 成员资格提供程序。对于不同的提供商（例如 SQL Server 会员资格提供商），我不确定我是否理解问题所在。你能详细说明一下吗？
在尝试再次阅读您的问题几次后，我将在这里进行猜测。如果“多个域”意味着您有多个网站（多个完全限定的域名），并且您想要使用相同的 SQL Server 数据存储来对用户进行身份验证并运行相同的网站，则解决方案是指向适当的 DNS原始托管服务器的 IP 地址的记录。
任何体面的域名注册商都应该允许您更改 DNS 记录。
但是，Forms Auth 会创建一个 cookie，并且由于明显的安全问题，您将无法从与您所在域不同的域读取 cookie，因此在这种情况下您将陷入困境。
我能看到的唯一可能性是您在查询字符串中传递一些加密的身份，但这是非常非常狡猾的，因为您希望确保它有一个最小的有效时间限制，因为它打开了一个正确的罐头蠕虫（安全漏洞）。可能不推荐。
Crikey，这是在说“不，你不能 - 安全”。
如果正在谈论子域而不是不同的顶级域，那么您实际上可以做到这一点，请参阅这篇文章。
If you are using Active Directory (assuming that is what you refer to as domains), you can simply configure multiple
ActiveDirectoryMembershipProvidersections and use theasp:Logincontrol templates, add a dropdown for the domains you want to authenticate against, and on theOnAuthenticateevent of the Login control, set the selected AD membership provider.For different providers like SQL Server membership provider, I'm not sure I understand what the issue is. Can you elaborate?
I'm going to take a guess here after having tried to read your question a couple of times again. If with 'multiple domains' you mean you have multiple websites (multiple fully qualified domain names), and you want to use the same SQL Server datastore to authenticate users against, and run the same website, the solution would be to point the appropriate DNS A record to the IP address of the original hosting server.
Any decent domain registrar should allow you to change the DNS record.
However, Forms Auth creates a cookie, and you will not be able to read the cookie from a different domain than that you are on because of obvious security issues, so in that case you're stuck.
The only possibility I can see is that you're passing some encrypted identity in a querystring, but that is very, very dodgy, as you would want to make sure there's a minimal validity time limit on it as it opens up a right can of worms (security holes). Probably not recommended.
Crikey, that's a long way of saying "No, you can't - securely."
If are talking about sub domains and not about different top level domains, then you can actually do it, see this post.