一套代码，两种身份验证方案 Forms Auth + Windows Auth：两害相权取其轻
我们有一个应用程序，当前需要使用两种身份验证方案进行访问：Forms Auth 和 Active Directory 或 NTLM / Windows Auth。
现在应用程序的方式是，有两个 IIS 站点指向具有相同文件集的不同文件夹，除了 web.config 之外，一切都相同。
在有人攻击我之前，这是一个继承的应用程序，但无论如何，我现在负责这个应用程序。我们有机会进行一些重构，我正在努力找出最好的进行方式。
假设应用程序的直接 NTLM 身份验证要求成立。您必须能够通过集成的 AD 提示访问该应用程序，从而允许内部网络上的员工完全无需手动登录即可访问该站点。
现在假设组织外部的用户也需要访问相同的应用程序。使用表单身份验证和会员资格提供程序。配置此应用程序的最不可怕的方法是什么？
有没有可能的方法将 IIS 配置为使用名为 web.config 以外的文件作为其配置文件？这可能会将这一切扼杀在萌芽状态。
在源代码控制中，我认为可行的方法是将所有源文件放在一个项目（一个“共享”项目）中，并使用构建时事件将其自身复制到两个消费项目的构建中。然后我们可以继续将应用程序部署在两个不同的文件夹中，但至少在源代码控制中，公共源文件将仅存在于一个位置。这样做的缺点是我们会失去动态编译，这真的很糟糕。但总比大量重复更好。
我对路由进行了一些实验，但似乎无法路由到应用程序根目录之外的文件，该文件需要不同才能定义不同的身份验证方案，所以我认为这行不通。
非常感谢任何想法、反馈或想法，
bd
We have an application that is currently required to be accessed using two authentication schemes, Forms Auth and Active Directory or NTLM / Windows Auth.
The way the application is now, there are two IIS sites pointing to different folders with the same set of files, everything identical except the web.config.
Before anyone flames me this was an inherited application, but nevertheless one I am now responsible for. We have an opportunity to do some refactoring and I'm trying to figure out the best way to proceed.
Let's say the requirements for straight NTLM authentication for the application stands. You have to be able to access the app with an integrated AD prompt, allowing the employees on the internal network to access the site without manually logging in at all.
Now suppose the same application also needs to be accessible from users outside the organization as well. Using forms authentication and the Membership provider. What's the least horrible way to configure this application?
Is there any possible way to configure IIS to use a file named something other then web.config for it's config file? That could nip this in the bud right there.
In source control I'm thinking the way to go is to have all the source files in one project, a 'shared' project, and use build time events to copy themselves into the two consuming web projects on build of either of the consuming projects. Then we can continue to deploy the application in two different folders but at least in source control the common source files will exist in only one place. The downside of this is we would lose dynamic compilation, which really sucks. But better that then a ton of duplication.
I did some experimentation with routing but it seems as if you can't route to a file outside of the application's root, which would need to be different to define the different authentication schemes, so I don't think that would work.
Any thoughts, feedback or ideas are greatly appreciated,
bd
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以尝试使用一种混合模式身份验证的网站。查看这篇文章：http://www .pluralsight-training.net/community/blogs/craig/archive/2004/07/24/1699.aspx。
这个想法是在 ASP.NET 配置中使用表单身份验证，并在 IIS 中标记匿名访问和 Windows 身份验证。因此，每当服务器发送 401 时，浏览器都会提供 Windows 凭据，否则将显示登录表单。文章作者在登录表单上提供了一个复选框，该复选框将发出 401 错误以获取 Windows 凭据，然后使用它们来发出身份验证票证。
另一种变化（从用户体验的角度来看）是有一个默认页面，该页面将请求 IIS 中的集成 Windows 身份验证（无匿名访问）。内部用户可以访问站点并通过此默认页面进行身份验证，然后默认页面将重定向到应用程序主页面。外部用户被要求使用进行表单身份验证的登录页面，然后重定向到主页。
You can try one web site with kind of mixed mode authentication. Check this article: http://www.pluralsight-training.net/community/blogs/craig/archive/2004/07/24/1699.aspx.
The idea is to have Forms Authentication in ASP.NET configuration and have both anonymous access as well as windows authentication marked in IIS. So whenever server sends an 401, browser will supply windows credentials otherwise login form will be display. The article author has provided a checkbox on login form that would issue 401 to get windows credentials and then use them to issue the authentication ticket.
Another variation (from user experience perspective) is to have a default page that will request integrated windows authentication in IIS (no anonymous access). Internal users can visit site and get authenticated via this default page and then default page will redirect to application main/home page. External users are requested to use login page that does forms authentication and then redirect to main page.