ASP.NET 4 中的双跳模拟、协议转换和约束委派
我想使用 IIS 模拟以当前正在访问网站的用户身份连接到 SQL Server 数据库。这是出于审计和安全原因。
我进行了一些阅读，发现由于 SQL Server 位于单独的物理服务器上，因此我需要为运行 IIS 的服务器启用协议转换和约束委派。这是我找到的文章... http://msdn.microsoft.com /en-us/library/ff649317.aspx
我第一次阅读时没有意识到，但这篇文章有以下标题...
已停用的内容
此内容已过时，不再适用 维护时间更长。这是 作为对个人的礼貌提供 谁还在使用这些 技术。该页面可能包含 最初有效的 URL 已发布，但现在链接到网站或 不再存在的页面。
我想知道的是，文章中的信息是否仍然适用，如果我想一直模拟用户到 SQL Server，我是否仍然需要约束委派，或者是否以其他方式为 ASP.NET 实现了这一点4？
I want to use IIS impersonation to connecto to a SQL server database as the user who is currently accessing a website. This is for auditing and security reasons.
I've done some reading and discovered that because the SQL Server is on a sepearate physical server I need to enable Protocol Transitioning and Constrained delegation for the server that's running IIS. This is the article that I found ... http://msdn.microsoft.com/en-us/library/ff649317.aspx
I didn't realise at the time I first read it but this article has the following header...
Retired Content
This content is outdated and is no
longer being maintained. It is
provided as a courtesy for individuals
who are still using these
technologies. This page may contain
URLs that were valid when originally
published, but now link to sites or
pages that no longer exist.
What I want to know is, does the information in the article still apply, if I want to impersonate the user all the way to the SQL Server, do i still need Constrained Delegation or has this been implemented in some other way for ASP.NET 4?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
约束委派是将模拟凭据信息传输到第二个主机的唯一方式。 ASP.Net 与它无关，只是一个使用 Kerberos 框架的普通应用程序。一切都没有改变。一旦 ASP.NEt 应用程序模拟由 IIS 验证的上下文（请参阅 配置 ASP.NET 模拟身份验证）适用相同的委派规则：
Constrained Delegation is the only way to flow impersonated credentials information to a second host. ASP.Net has nothing to do with it, is just an ordinary app that uses the Kerberos framework. Nothing changed. Once the ASP.NEt applicaiton impersonates the context authenticated by IIS (see Configure ASP.NET Impersonation Authentication) the same rules for delegation apply: