让 Windows 身份验证和 WKHTMLToPDF 发挥良好作用
我面临着从 ASP.NET 网站上的 HTML 页面生成 PDF 的任务。 （用户可以很好地保存/打印的东西）
我发现 WKHTMLToPDF 做得很好，看了这个：
但是，我有一个问题。我们的网站是一个 Intranet 站点并使用 Windows 身份验证。我可以使用 --username 和 --password 将我的凭据传递给 WKHTMLToPDF，并向自己证明网页是按照您希望的方式生成的。
问题是这样的：对于进入我们系统的每个不同用户该怎么办？我可以想到一些可能/可能不起作用的可能解决方案，我希望有人能给我一些意见/指导，因为我似乎已经结束了我的研究。
可能的解决方案：
- 在 ASP.NET 中是否有任何方法可以从用户凭据中提取用户名和密码以传递到 WKHTMLToPDF 中？我怀疑这个问题的答案是“不，并且出于合理的原因”
- 是否可以运行该流程并传递用户凭据？我可以看到可以在进程上设置用户名/密码（尽管我不知道如何从凭据中传递它，因为密码似乎没有暴露）。也许还有另一种方法可以将凭据直接传递给 Process？
- 我可以创建一个不使用 Windows 身份验证的单独 PDFGenerator 网站。然后，我可以将 HTML/CSS/图像从安全网站移植到共享目录，然后将用户重定向到 PDFGenerator 网站，以实际从 HTML 生成 PDF，而不必担心身份验证（并且会在 PDF 之后清理 HTML 等）生成）。
我怀疑 3 是我最终会追求的解决方案，但由于这本质上是处理身份验证问题的一个大解决方法，我非常愿意接受关于 1 或 2 的更好建议或帮助！
I'm faced with the task of generating a PDF from an HTML page on an ASP.NET website. (Something the users can save away/print nicely)
I've found that WKHTMLToPDF does the job very well having looked at this:
Calling wkhtmltopdf to generate PDF from HTML
However, I have a problem. Our website is an intranet site and uses Windows Authentication. I can pass in my credentials to WKHTMLToPDF using --username and --password and demonstrate to myself that the web page is generated as you would hope.
The problem is this: What to do for each different user that comes into our system? I can think of a number of possible solutions which may / may not work and I was hoping someone could give me some opinions/ guidance as I seem to have come to the end of my researches.
Possible solutions:
- Is there any way in ASP.NET that I can extract username and password from Users credentials for passing into WKHTMLToPDF? I suspect the answer to this is "no and for sensible reasons"
- Is it possible to run the Process and pass through the Users credentials? I can see it's possible to set Username / Password on process (though I don't know how I would pass this from the credentials since password seems not to be exposed). Perhaps there is another method for passing credentials directly to Process?
- I could create a separate PDFGenerator website which does not use windows authentication. I could then port out the HTML/CSS/images from the secured website to a shared directory and then redirect users to the PDFGenerator website to actually generate the PDF from the HTML without having to worry about authentication (and would clean up HTML etc after PDF generated).
I suspect that 3 is the solution that I will end up persuing but since that's essentially one big workaround to deal with the authentication issue I'm very open to better suggestions or help on 1 or 2!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以在 web.config 中设置模拟：
http ://msdn.microsoft.com/en-us/library/aa292118%28v=vs.71%29.aspx
这意味着执行的任何内容都是以用户身份完成。但在某些情况下这可能会导致问题。这意味着该网站运行时使用的是该会话的用户凭据，而不是应用程序池的身份，并且您必须费尽周折才能将 Web 应用程序设置为正常运行且仍然安全。
您应该注意，在大多数正常配置下，您运行的任何内容都将采用应用程序池的凭据。您可以更改应用程序池的帐户。这可能允许您通过仅允许运行应用程序池的用户进行访问来锁定事物。
其他替代方案可能是除了使用模拟的主应用程序之外还有另一个应用程序。这可能比将整个应用程序转换为使用模拟更容易管理。 （我没有你的项目的详细信息，所以很难在这里提出具体的建议。）
You can set up impersonation in web.config:
http://msdn.microsoft.com/en-us/library/aa292118%28v=vs.71%29.aspx
This means anything that is executed is done as the user. This can cause problems though in certain scenarios. This means that the site is running with the user's credentials for that session rather than the identity of the app pool, and you'll have to jump through hoops to set up the web app to function properly and still be secure.
You should note that anything you run is going to take on the credentials of the app pool under most normal configurations. You can change the account for the app pool. This might allow you to keep things locked down by allowing access only from the user that is running the app pool.
Other alternatives might be to have another app aside from the main app that uses impersonation. This might be easier to manage than converting your entire app to use impersonation. (I don't have details of your project, so it is hard to make a concrete recommendation here.)