使用 VB.NET 进行 Intranet Active Directory 身份验证
我正在开发一个 Intranet Web 应用程序，并且正在学习如何将 VB 连接到 Active Directory。我们将执行一些特定于位置的权限，我的老板希望（如果可能的话）我连接到 Active Directory 以获取用户位置。
我认为我需要做的就是获取用户名，但我不确定最好的方法是什么。我们是一家仅限 Microsoft 的商店，因此 IE 和 IIS 是当今的主流。要访问 Intranet，您必须使用我们的域登录到计算机，因此这是一种安全级别，但随后我需要进行身份验证并确保用户有权进行更改。我想我们要么在 AD 信息中添加一个修饰符（如果还没有），要么在数据库中保留一个权限表，但前者可能是首选。
我知道 IIS 有一个允许/需要身份验证的功能，但我不太确定它是如何工作的。
那么获取用户凭据的最佳/最简单/某种程度上（最？）安全的方法是什么？我总是可以创建一个登录页面，但如果我可以在后台获取他们的 AD 凭据，那就更好了。
谢谢！
I'm developing an intranet web app and I'm learning how to hook VB into the Active Directory. We're going to be doing some location specific permissions, and my boss wants (if possible) me to hook into the Active Directory to get the users location.
I think that all I need to do is get the user name, but I'm not sure what is the best way to do that. We're a Microsoft only shop, so IE and IIS are the order of the day. To access the intranet you have to log on to the computer using our domain, so that's one level of security, but then I need to authenticate and make sure that user has permissions to make the changes. I'm thinking we'll either have a modifier (if there's not one already) in the AD info, or keep a permissions table in a database, but the former is probably preferred.
I know that IIS has a feature that allows/requires authentication but I'm not exactly sure how that's supposed to work.
So what's the best/easiest/somewhat(most?) secure way to get the users credentials? I could always do a login page but it would be much nicer if I could just get their AD credentials in the background.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您需要禁用 IIS 站点的匿名身份验证并启用 windows-auth。
现在转到您的 web.config 并更改以下内容，
请参阅 http://msdn.microsoft.com/en-au/library/532aee0e(v=VS.80).aspx
&
如果需要，
请参阅 http://msdn.microsoft.com/ en-us/library/aa292118(VS.71).aspx
现在您应该能够获取当前用户以
检查该用户是否位于您可以使用的特定组中
you need to disable anonymous auth for your IIS site and enable windows-auth instead.
now go to your web.config and change the following
see http://msdn.microsoft.com/en-au/library/532aee0e(v=VS.80).aspx
&
if neccesary
see http://msdn.microsoft.com/en-us/library/aa292118(VS.71).aspx
now you should be able to get the current user with
to check if the user is in a specific group you can use
IIS 可以配置为使用集成身份验证，这将使您能够访问用户的 samaccountname（Windows 2000 之前的登录）。这样您就可以对 AD 进行 LDAP 查询并检查组成员身份。如果用户是 CanModifyStuffGroup 的成员（您在 AD 中创建并向其添加用户），则让他们进行更改，否则为他们提供只读版本 - 或其他任何内容。
IIS can be configured to use Integrated Authentication which will give you access to the samaccountname (pre-Windows 2000 logon) of the user. With that you can do an LDAP query against AD and check group membership. If the user is a member of the CanModifyStuffGroup (that you have created within AD and added users to) then let them make changes, otherwise give them the read-only version - or whatever.