SaaS 身份验证
建议采用什么作为软件即服务产品的身份验证解决方案？
具体来说，我的产品的客户通常信息技术技能较低，甚至可能在其组织内没有 IT 部门。我仍然希望我的应用程序针对其内部目录服务（eDirectory、Active Directory 等）进行身份验证。然而，我不希望他们必须打开/转发端口（例如，打开端口 636，以便我可以直接将 LDAPS 绑定到他们的目录服务）。
我的一个想法是在其组织网络内的服务器上安装一个应用程序，该应用程序将反向连接到我的服务。这将是一个持久套接字。当我需要对用户进行身份验证时，我通过套接字发送凭据（加密） - 然后应用程序执行绑定/任何操作以对目录服务进行身份验证，并回复 OK/FAIL。
你有什么建议？我的目标本质上是让客户端在其网络中安装应用程序，只需很少的配置或干预。
What would be recommended as an authentication solution for a Software-as-a-service product?
Specifically, my product would have clients that would typically have low information technology skills, potentially not even having an IT department within their organization. I would still like to have my application authenticate against their internal directory service (eDirectory, Active Directory, etc.). I don't want them, however, to have to open/forward ports (for instance, opening up port 636 so I can do LDAPS binds directly to their directory service).
One idea I had was to have an application installed on a server within their organization's network that would backconnect to my service. This would be a persistant socket. When I need to authenticate a user, I send the credentials via the socket (encrypted) - the application then performs a bind/whatever to authenticate against the directory service and replies with OK/FAIL.
What would you suggest? My goal here is to essentially have the client install an application within their network, with very little configuration or intervention.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
该供应商 Stormpath 提供的服务正是您所要求的：用户身份验证、用户帐户管理，以及连接到客户的本地目录（如果需要，就像您的情况一样）。
This vendor, Stormpath, offers a service providing exactly what you are asking for: user authentication, user account management, with hookups to your customers’ on-premise directories (if need be, as is your case).
我认为在你的情况下，有必要在他们的网络上放置一个代理，在本地执行身份验证，然后创建一个签名令牌，向你的 SaaS 应用程序“证明”它已经这样做了；这可以由浏览器在查询字符串或表单帖子中传递（例如）。
该代理可能是一个可安装 IIS 的 Web 应用程序，它只能对用户进行身份验证，然后将他们定向到云中的服务器。这不应该成为安装的主要麻烦，但会产生技术支持问题。特别是，您需要第一次就正确设置该组件，因为用户不会定期更新它。
让它安全地工作可能会很有趣。
I think in your case, it'd be necessary to drop an agent on to their network which performs the authentication locally, then creates a signed token which "proves" to your SaaS app that it has done so; this can be passed on by the browser in a query string or form post (for example).
The agent might be an IIS-installable web app which can just authenticate the user and then direct them on to your servers in the cloud. This should not be a major hassle to install, but will create tech support issues. In particular, you need to get this component right first time, as users are not going to update it on a regular basis.
Making it work securely may be interesting.