如何确保使用您的域凭据登录的应用程序不会存储您的密码？
有多个应用程序使用您的域凭据进行登录。例如：自定义企业应用程序。您如何确保此类应用程序不会存储您的密码？
我问这个问题的原因是：如果您正在设计一个执行相同操作的应用程序，您如何说服用户可以信任您的应用程序不会存储密码？
There are several applications that use your domain credentials for login. Eg: Custom Corporate apps. How do you ensure that such applications don't store your password?
The reason I am asking this is: If you are designing an app which does the same thing, how do you convince the user that your app can be trusted not to store the password?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您使用了标准的基于 AD 的 Windows 身份验证，他们不应该拥有您的密码，但他们肯定可以使用您的用户上下文执行操作。
如果您使用标准 Windows 身份验证提供用户名/密码来登录，那么您无法确定他们没有保存该用户名/密码。
如果 Windows 身份验证颁发的登录令牌过期了，这可能是一个不同的故事，但我不相信这就是它的工作原理，并且对于第二种情况肯定仍然毫无用处。
If you have used standard AD-based Windows authentication they shouldn't have your password but they could certainly perform actions using your user context.
If you provide a username/password to login using standard Windows authentication then there is no way for you to be sure they haven't saved that.
If Windows auth issued login tokens that expired this might be a different story, but I do not believe that is how it works and certainly would still be useless with the second case.
如果您确实希望用户确定您的应用没有保留他们的密码，请不要使用他们的密码。
Microsoft Active Directory 域登录使用 Kerberos。 Kerberos 是一种 SSO 解决方案；应用程序可以使用用户的 Kerberos 凭据，而无需用户再次输入密码。应用程序获得的凭据可能仅在用户的 Kerberos 票证有效期内有效 - 可能最多一周。
如果您有一个 Web 应用程序，它也可以通过 SPNEGO 参与到温暖的善良中。您可能已经以 Sharepoint 网站的形式看到了这一点，如果您位于公司域中，则不需要登录。
If you really want the user to be sure your app is not keeping their password, don't use their password.
Microsoft Active Directory Domain Logon uses Kerberos. Kerberos is an SSO solution; an application may make use of a user's Kerberos credentials without requiring that the user enter their password a second time. The credentials obtained by the application may only be valid for as long as the user's Kerberos ticket - probably at most a week.
If you have a web application, it too may take part in the warm goodness via SPNEGO. You may have seen this in the form of Sharepoint sites that don't require a login if you are on the company domain.