活动目录 WCF 服务
我想知道使用 AD 管理用户身份验证和授权可能有哪些解决方案/选项？我现在的情况是，我们想要使用 AD 帐户/组/等来管理我们的用户（内部和外部）。我找到了这篇文章（http://blog.waleedmohamed。 net/2009/12/create-active-directory-service-using.html），显示了公开一些 AD 操作的简单 WCF 服务。
我的想法是创建一个 AD WCF 服务，多个应用程序可以使用该服务来执行帐户 CRUD 操作以及其他所需的功能，例如登录和密码检索。拥有如此强大的服务是一个好主意吗？我们正在考虑让该服务使用仅具有某些 OU 权限的帐户来限制其权限。
谢谢！
I'm wondering what solutions/options I might have for managing user authentication and authorization with AD? I'm in a situation where we want to use AD accounts/groups/etc to manage our users, both internal and external. I found this article (http://blog.waleedmohamed.net/2009/12/create-active-directory-service-using.html) that shows a simple WCF Service exposing some AD operations.
My thought is to create an AD WCF Service which multiple apps can consume for account CRUD operations and other needed functions like logging in and password retrieval. Is this a good idea to have a service with this much power? We're thinking about having the service use an account that only has permissions on certain OU's to limit its power.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
许多 CRUD 操作只能由域管理员完成。作为一种方法，这需要 WCF 服务以域管理员身份运行，在这种情况下，如果有人可以侵入并运行代码，则可能非常危险。Windows
身份验证（在 IIS 中）无法传递身份验证令牌到 DC，因为 IIS 很可能不在 DC 上运行。
另一方面，用户可以在安全会话中传递用户名/密码（可能通过 SSL），并将其用于连接到域控制器。只要你能保证它，那就没问题。
A lot of CRUD operations can be done by Domain Admins only. As one approach, this would require the WCF service to be running as Domain Admin in which case it is probably very dangerous if someone can hack into and run a code in.
Windows authentication would not work (in IIS) to pass the authentication token across to DC since most likely IIS is not running on DC.
On the other hand, user can pass username/password in a secure session (possibly over SSL) and it would be used to connect to Domain Controller. As long as you can secure it, it could be fine.
我问了类似的问题，也只能找到您找到的资源。我喜欢这个想法，因为我有多个与 AD 交互的内部应用程序，这些应用程序已经使用我创建的 AD Helper 库。我想从该 AD Helper 库创建一个 WCF 服务，以便在需要添加或修复功能时维护单个应用程序，而不是重新访问使用 AD Helper 库的每个应用程序。
我关心的是重新发明轮子。我不想实现 MS 可能已经实现的东西。有人建议我查看 Active Directory Web 服务，看看它是否已经实现了我在 AD Helper 库中实现的功能。据我所知，这只是与 AD 交互的另一种方式，我已经使用 System.DirectoryServices 命名空间做到了这一点。
我认为，如果实施得当，这将是对任何开发环境的一个极好的补充，可以将其内部应用程序与 Active Directory 更统一地集成，并集中对此实施的维护。
I asked a similar question and was also only able to find the resource you found as well. I like the idea since I have multiple internal applications that interface with AD already using an AD Helper library I've created. I want to create a WCF service from that AD Helper library in order to have a single application to maintain should I need to add or fix functionality instead of revisiting every application that utilizes the AD Helper library.
My concern is reinventing the wheel. I don't want to implement something that MS may already have an implementation to. It was suggested to me to look at Active Directory Web Services to see if that's something that already does what I've already implemented within my AD Helper library. From what I can tell, it's just another way of interfacing with AD which I already do using the System.DirectoryServices namespace.
I think if implemented properly, this would be an excellent addition to any development environment to more uniformly integrate their internal applications with Active Directory and centralize their maintenance of this implementation.
我会非常注意实现 WCF 服务的安全性，例如将其置于端口 443 (SSL) 上。还会想到通过特定 IP 范围 (IIS) 限制对服务器的访问。
I would pay a lot of attention to implementing security for the WCF service, such as having it on port 443 (SSL). Restriction of access to the server by certain IP range (IIS) comes to mind as well.