IIS 7.5 我做错了什么？

发布于 2024-09-01 22:57:24 字数 897 浏览 2 评论 0原文

在 Windows 7 Utilmate 下的 IIS 7.5 中，我有一个配置为身份验证的应用程序，如下所示：匿名& Windows

在 ASP.NET 网站中，我已将 Forms 身份验证和身份模拟 = true 我也拒绝任何匿名用户。

<authentication mode="Forms">
</authentication>
<identity impersonate="true"/>
<authorization>
<deny user="?">
</authorization>

IIS 抱怨。我做错了什么... 我想要实现的目标：我想要 Windows 登录用户，以便我可以构建 FormsAuthentication 票证并将其传递给被动 STS。因此，在 IIS 中，我有匿名和 Windows...如果只勾选了 Windows，我无法进入 Login.aspx 页面，因为我有一个额外的参数要从那里传递。所以现在在 webconfig 中，我通过拒绝用户 =“?” 来禁用匿名用户。，所以它给我留下了经过身份验证的 Windows 用户，但使用表单身份验证。你知道我的意思吗？

http://msdn.microsoft.com/en-us/library/ff649264。 aspx

如果您看到表 4 IIS Integrated Windows for IIS 那么 Web.config 设置第 3 行，相应的 WindowsIdentity 为 Domian\Username 。它适用于 XP 下的 IIS 6.0 win2003/IIS 5.1

原文

In IIS 7.5 under Windows 7 Utilmate, I have an application which is configured for authentication as follows:
Anonymous & Windows

In the ASP.NET Website, I have turned Forms authentication and identity impersonate = true
I also deny any anonymous users.

<authentication mode="Forms">
</authentication>
<identity impersonate="true"/>
<authorization>
<deny user="?">
</authorization>

IIS complains. What am I doing wrong...
What I want to achieve :I want the windows Logged On User so I can build a FormsAuthentication ticket and pass it to a Passive STS.
So in IIS I have anonymous and windows...If have only windows ticked, I cannot go onto the Login.aspx page as I have an extra parameter to be passed from there.
So now in webconfig, I then disable anonymous users by saying deny user="?" , so it leaves me with the authenticated windows user but using Forms Authentication.You know what I mean??

http://msdn.microsoft.com/en-us/library/ff649264.aspx

If you see Table 4 IIS Integrated Windows for IIS then Web.config setting 3rd row, accordingly WindowsIdentity is Domian\Username .It works on IIS 6.0 win2003/IIS 5.1 under XP

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

夏日浅笑〃 2024-09-08 22:57:24

如果这是一个利用基于声明的身份的应用程序，则对用户进行身份验证的责任在于 STS 本身，而不是应用程序。

如果您将（Web）应用程序配置为信任外部 STS，那么您的身份验证模式将为“无”，并且您的配置文件中将有一整段“Microsoft.身份模型”。然后，您可以在那里配置 STS 地址（发行者属性）。像这样的事情：

<microsoft.identityModel>
<service>
  <audienceUris>
    <add value="https://aexpense-dev.adatum.com/" />
  </audienceUris>
  <federatedAuthentication>
    <wsFederation passiveRedirectEnabled="true" issuer="https://localhost/Adatum.SimulatedIssuer/" realm="https://aexpense-dev.adatum.com/" requireHttps="true" />
    <cookieHandler requireSsl="false" />
  </federatedAuthentication>
  <serviceCertificate>
    <certificateReference x509FindType="FindBySubjectDistinguishedName" findValue="CN=localhost"/>
  </serviceCertificate>
  <certificateValidation certificateValidationMode="None"/>
  <applicationService>
    <claimTypeRequired>
      <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="true" />
    </claimTypeRequired>
  </applicationService>
  <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
    <trustedIssuers>
      <add thumbprint="f260042d59e14937984c6183fbc6bfc71baf5462" name="https://localhost/Adatum.SimulatedIssuer/" />
    </trustedIssuers>
  </issuerNameRegistry>
</service>

STS 本身可能使用表单身份验证或其他身份验证，具体取决于实现。

If this is an application that leverages claims based identity, then the responsibility of authenticating users is in the STS itself, not in the app.

If you are configuring your (web) application to trust an external STS, then your authentication mode would be "None" and you'd have a whole section in the config file for "Microsoft.identityModel". You would then configure the STS address there (the issuer attribute). Something like this:

<microsoft.identityModel>
<service>
  <audienceUris>
    <add value="https://aexpense-dev.adatum.com/" />
  </audienceUris>
  <federatedAuthentication>
    <wsFederation passiveRedirectEnabled="true" issuer="https://localhost/Adatum.SimulatedIssuer/" realm="https://aexpense-dev.adatum.com/" requireHttps="true" />
    <cookieHandler requireSsl="false" />
  </federatedAuthentication>
  <serviceCertificate>
    <certificateReference x509FindType="FindBySubjectDistinguishedName" findValue="CN=localhost"/>
  </serviceCertificate>
  <certificateValidation certificateValidationMode="None"/>
  <applicationService>
    <claimTypeRequired>
      <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="true" />
    </claimTypeRequired>
  </applicationService>
  <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
    <trustedIssuers>
      <add thumbprint="f260042d59e14937984c6183fbc6bfc71baf5462" name="https://localhost/Adatum.SimulatedIssuer/" />
    </trustedIssuers>
  </issuerNameRegistry>
</service>

The STS itself might use Forms authentication or something else, depending on the implementation.

回复收藏 0 原文

~没有更多了~