Active Directory 如何存储密码？这样我就可以模仿
有人可以告诉我 Active Directory 如何存储用户的密码吗？
不是像这个答案：在 SQL Server 中存储密码
是 哈希和盐还是多个哈希？
编辑
我问是因为我想模仿他们为我想要构建的自定义授权应用程序存储它们的方式。或者，如果有人可以提供一个现有的框架或类来处理 Web 应用程序的用户授权。如果我可以通过 Web 服务将 asp.net 成员身份用于多个应用程序，那就更好了。
Can someone tell me how Active Directory stores it's passwords for users?
Is it like this answer : storing passwords in SQL Server
Is it a hash and a salt or multiple hashes?
EDIT
I ask because I want to mimic the way they store them for a custom authorization application I want to build. Or if someone can offer a existing framework or class that handles user authorization for a web application. If I can use asp.net membership for multiple applications using web service that would be even better.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
模仿 Microsoft 存储自定义授权密码的方式的最佳方法是在 Windows Server 2008 R2 上设置 Active Directory 轻型目录服务 (AD LDS) 或在 Windows Server 2003 上设置 Active Directory 应用程序模式 (ADAM)。LDS 和 ADAM 是轻量级的Windows Server 2008 R2 和 Windows Server 2003 操作系统中的目录访问协议 (LDAP) 目录服务为启用目录的应用程序提供灵活的支持，而不受 Active Directory 域服务 (AD DS) 的依赖性和域相关限制。您可以在成员服务器或独立服务器上运行它们。您还可以在一台服务器上运行 AD LDS 的多个实例，每个实例都有自己独立管理的架构。
使用Windows Server 2008的AD DS提供的细粒度密码策略，您可以拥有不同的密码策略。但AD LDS不提供Fine-Grained密码策略的功能。但是您可以将 LDS 安装在工作组服务器上，它将有自己的策略。
The best way to mimic the way Microsoft store the password for a custom authorization is to setup Active Directory Lightweight Directory Services (AD LDS) on Windows Server 2008 R2 or Active Directory Application Mode (ADAM) on Windows Server 2003. LDS and ADAM are Lightweight Directory Access Protocol (LDAP) directory services in the Windows Server 2008 R2 and Windows Server 2003 operating system that provides flexible support for directory-enabled applications, without the dependencies and domain-related restrictions of Active Directory Domain Services (AD DS). You can run them on member servers or stand-alone servers. You can also run multiple instances of AD LDS—each with its own independently managed schema—on one server.
Using Fine-Grained password policies which is provided by AD DS of Windows Server 2008, you can have different password policies. However, the AD LDS doesn't provide the function of Fine-Grained password policy. But you can install your LDS on a Workgroup server it will have his own policy.
使用 ASP.NET SqlMembershipProvider 它将进行加密的 2 向密码或加盐的单向哈希（我自己更喜欢 1 向哈希）。
您可以使用 aspnet_regsql.exe 工具在 C:\Windows\Microsoft.NET\Framework\vX.XXX 文件夹中为您创建数据库架构。
我不建议用手滚动它。有很多问题已经被其他人解决了。
Use the ASP.NET SqlMembershipProvider It will do encrypted 2-way passwords or salted one-way hashes (I prefer the 1-way hash myself).
You can use the aspnet_regsql.exe tool in your C:\Windows\Microsoft.NET\Framework\vX.XXX folder to create the database schema for you.
I would not recommend rolling this by hand. There are a lot of gotchas which have already been solved by others.