如何编写 NTLM 身份验证模块？
我需要为 IIS7 编写一个身份验证模块，其行为与 NTLM 完全相同，但会进行一些额外的检查。该模块针对 Active Directory 执行 NTLM（以便模块知道用户是否正常），然后需要调用另一个服务来最终验证访问。
我必须在身份验证模块中执行此操作，因为 IIS 网站上的实际内容是通过自定义 IIS 模块提供的，这对我来说是一个黑匣子，而且我无法修改客户端，因为它也是一个黑匣子。另外，我无法使用 Windows 安全组，因为我需要调用的服务有它自己的用户数据库。
我发现这篇关于编写 自定义身份验证提供程序< /a>，但我真的不知道如何根据 Active Directory/Windows 验证用户。
有谁对我如何实施 NTLM 有一些提示吗？不必以 IIS 为中心，我的问题更多是“我从客户端浏览器获得什么以及如何验证它”？
I would need to write an Authentication Module for IIS7 that behaves exactly like NTLM, but does some extra checking. The Module does NTLM against Active Directory (so that the module knows if the user is OK) and then needs to call another service to finally verify access.
I have to do this in an Authentication Module because the actual content on the IIS WebSite is served through a custom IIS Module that's a Black Box to me and I can't modify the client since that's also a Black Box. Also, I cannot use Windows Security Groups as the service I need to call has it's own User Database.
I found this article about writing a custom Authentication provider, but I don't really know how I can verify the user against Active Directory/Windows.
Does anyone have some hints how I could implement NTLM? Doesn't have to be IIS Centric, my problem is more "What do I get from the Client's Browser and how do I verify it"?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您所描述的听起来不像身份验证提供程序，听起来像是您想编写一个授权提供程序。
为此，我将处理 AuthorizeRequest 并使用已经具有有效 Windows 身份验证令牌的 HttpContext.User（假设您启用了 Windows 身份验证）。
此时，您可以使用 IsUserInRole 和其他 API 从 ActiveDirectory 获取其他数据，或使用 System.DirectoryServices 获取其他数据。只需确保进行一些缓存，因为每个请求都进入 AD 可能会产生性能问题。至少 IIS 会为您处理具有缓存的 Windows 身份验证。
What you are describing does not sound like an Authentication Provider, it sounds like you want to write an Authorization Provider.
For that I would handle the AuthorizeRequest and use the HttpContext.User that will already have a valid Windows Authentication token (assuming you enabled windows authentication).
At that point you can use IsUserInRole and other APIs to get additional data from ActiveDirectory or use System.DirectoryServices to get additional data. Just make sure that you do some caching since going to AD for every single request might be a performance issue. At least IIS will handle the Windows Auth for you which does have a cache.
看看 Waffle，它用 Java 完成所有动作。因此，您可以将其反向移植到另一种语言/基础设施中。
Look at Waffle, which does all the motions in Java. So you would backport this into another language/infrastructure.