Winforms 应用程序作为“离线模式”网络应用程序的
我在这里看到了类似的问题，但没有一个真正解决了我的情况，设置如下：
我有一个带有表单身份验证 (SqlMembershipProvider) 的 ASP.NET 应用程序，用户可以在其中提交审核结果。
我想创建一个轻量级桌面应用程序（让我们称之为MyApp）（离线使用），以便用户可以在没有互联网连接时提交审核结果。
以下是必须具备的：
- 根据我的 SqlMembershipProvider 对用户进行身份验证（匿名用户无法提交审核结果）
- 仅询问用户一次凭据（当他/她打开 MyApp 时）（我将能够保存身份验证令牌，但在某些情况下 MyApp 将安装在多个用户使用的笔记本电脑上，因此我必须强制用户每次 MyApp< 时登录/em> 已打开）
- 不要以纯文本形式存储密码（如果打开 MyApp 时用户处于离线状态，我想在连接可用时保存凭据以对用户进行身份验证） - 不确定是否 这是可能的
一旦我弄清楚了上述三件事，
——剩下的就很容易了。下面是一个简单的场景，以防上述内容令人困惑：
- MyApp 安装在办公室笔记本电脑上，人们在旅行时随身携带
- 2 个用户前往偏远地区（没有互联网），并进行 2 个单独的审核
- 用户1 打开 MyApp，提供他的用户/通行证（请参阅“必须具备”中的 #2），提交 3 个结果（我将保存结果以及用户的凭据以验证用户身份，并在连接可用时提交结果） - 请参阅 #1必须具备的#3
- 用户 2 打开 MyApp，并执行与用户 1 在步骤 3 中所做的相同的例程。2
- 天后，他们回到办公室，互联网可用，步骤 3 和 4 的结果提交到我的网站-app 代表各自的用户
我已经研究了 Microsoft Sync 框架，但这对于我正在做的事情来说似乎有点矫枉过正（而且我不确定它是否可以满足我的必备条件）。
我愿意接受任何替代方法，只要它们能够满足我的必备条件。
感谢您的帮助。
I saw similar questions here, but none of them really addressed my situation, here's the setup:
I have an ASP.NET application with Forms Authentication (SqlMembershipProvider) where users can submit audit findings.
I want to create a lightweight desktop app (let's call it MyApp) (to use Offline) so that users can submit audit findings when they don't have internet connectivity.
Here are the MUST-HAVES:
- Authenticate the user against my SqlMembershipProvider (anonymous users can't submit audit findings)
- Only ask the user for credentials ONCE (when s/he opens MyApp) (I'll have the ability to save the authentication token, but in some cases MyApp will be installed on a laptop that's being used by multiple users, hence I'll have to force users to login every time MyApp is open)
- Do NOT store password in plain-text (if user is offline when MyApp is opened, I want to save the credentials to authenticate the user whenever connection is available) - not sure if this is possible
Once I get the 3 things above figured out - the rest is easy.
Here's a simple scenario in case the above is confusing:
- MyApp is installed on the office laptop, that people take along when they travel
- 2 Users travel to remote area (no internet), and conduct 2 separate audits
- User 1 opens MyApp, provides his user/pass (see #2 in MUST-HAVES), submits 3 findings (I'll save the findings along with user's credentials to authenticate the user and submit the findings whenever connection becomes available) - see #1 and #3 in MUST-HAVES
- User 2 opens MyApp, and does the same routine as User 1 did in step 3.
- 2 days later they come back to the office, internet is available, findings from steps 3 and 4 are submitted to my web-app on behalf of respective users
I've looked into Microsoft Sync framework, but that seemed like an overkill for what I'm doing (and I'm not sure if it can accommodate my MUST-HAVES either).
I'm open to any alternative approaches as long as they would account for my MUST-HAVES.
Thank you for your help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这里隐藏着一个棘手的问题。多个用户在同一台笔记本电脑上输入报告的用例表明，用户必须在输入审核报告之前进行身份验证，而不是在应用程序重新连接后提交审核报告时进行身份验证。
身份验证应该告诉用户他们输入的凭据是否正确，因此您需要将用户凭据数据库同步到笔记本电脑。这是一个重大的安全风险，需要非常小心地完成，即使用户数据库已加密并使用散列、加盐的密码。例如，您可能只想同步用户记录的子集 - 将使用该应用程序的用户。
因此，假设您这样做了，那么您可以使用在 ASP.NET 应用程序上使用的同一身份验证提供程序来对用户进行身份验证，并在连接应用程序时重新同步该数据库。您不需要将其凭据存储在数据库中，正如我提到的，应该使用 Windows 数据保护 API 或类似的强大功能。
如果您可以通过允许用户将报告与其帐户关联起来，只需输入用户名，在重新连接时上传（但不提交）报告，并要求用户通过并按正常方式验证后确认上传的报告。
There's a tough problem hidden here. The use case of multiple users entering reports on the same laptop suggests that users must authenticate before they enter an audit report, as opposed to authenticating when they submit the audit report once the app is re-connected.
Authentication should presumably tell the users whether the credentials that they entered were correct or not, so you need to synchronize the user credential database to the laptop. That is a significant security risk and needs to be done very carefully, even if the user database is encrypted and uses hashed, salted passwords. You probably want to only sync a subset of users' records for instance- the ones who would be using the app.
So let's assume that you do that- then you can use the same authentication provider that you use on the ASP.NET application to authenticate the users, and re-sync that database whenever the application is connected. You don't need to store their credentials other than in the database, which as I mentioned should be encrypted using the windows data protection API or something similarly strong.
All of this could be simplified if you could get around the requirement by allowing the users to associate the reports with their account by just typing in a username, uploading (but not submitting) the reports when they reconnect, and requiring that the users connect via the website and confirm the uploaded report after authenticating the normal way.