如何将用户重定向到不同的服务器并包含 HTTP 基本身份验证凭据？

发布于 2024-11-15 18:53:11 字数 190 浏览 1 评论 0原文

我有一个 Web 应用程序（C# - ASP.net），需要使用 HTTP 基本身份验证将用户传递到远程 Apache 服务器上的页面。我需要能够将用户名和密码传递到该服务器，以允许通过我的应用程序进行身份验证的用户无缝使用其他应用程序，而不会提示输入他没有的凭据。切换应该是安全的，因为只要用户名和密码不在客户端脚本中，两个系统都需要 SSL。有办法做到这一点吗？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

初吻给了烟 2024-11-22 18:53:11

基本身份验证详细信息编码在客户端名为“Authorization”的请求标头中。标头包含“用户名：密码”的base64编码结果。

例如 Aladdin:open sesame = 授权：基本 QWxhZGRpbjpvcGVuIHNlc2FtZQ==

有关基本访问身份验证维基百科页面。

对于基本身份验证，需要将授权标头添加到每个请求中。通常，在用户将其凭据输入浏览器显示的对话框后，浏览器会处理此问题。如果您想避免让用户输入这些凭据，那么您的 ASP.net 服务器将需要位于用户和 Apache 服务器（充当反向代理）之间，将身份验证标头添加到它代表其转发的每个请求中。您的用户。

不可能简单地访问您的服务器一次，然后将“令牌”添加到请求中，然后重定向到 apache 服务器。如果您使用表单/cookie 进行身份验证，并且您的服务器将自己呈现给同一域内的用户（例如 asp.domain.com 和 apache.domain.com），那么可以将身份验证 cookie 设置为父域（例如domain.com）和共享 - 请参阅表单身份验证子域。

假设 Apache 服务器上的基本身份验证方案不是您可以轻松更改的内容，则看起来像

.net 将使用如下方式处理代理请求中的凭据编码：

RemoteServer remoteServer = new RemoteServer(httpContext);
HttpWebRequest request = remoteServer.GetRequest();
request.PreAuthenticate = true;
request.Credentials = new NetworkCredential(UserName, SecurelyStoredPassword);

Basic authentication details are encoded in the request header named "Authorization" from the client. The header contains the base64 encoded result of "username:password".

e.g. Aladdin:open sesame = Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

There are more details on the Basic Access Auth wikipedia page.

For basic authentication, the Authorization header needs to be added to every request. Usually the browser will take care of this after the user has entered their credentials into the dialog presented by the browser. If you want to avoid having your users enter these credentials, then your ASP.net server will need to sit in between the user and the Apache server (acting as a reverse proxy) adding the auth headers to every request that it forwards on behalf of your users.

It is not possible to simply visit your server once and for it to add a "token" to the request then redirect to the apache server. This approach would be possible if you were using forms/cookies for authentication and your servers presented themselves to the user as within the same domain (e.g. asp.domain.com & apache.domain.com) then the auth cookie could be set on the parent domain (e.g. domain.com) and shared - see Forms Authentication across sub-domains.

Assuming that the basic auth scheme on the Apache server is not something you can easily change, it seems like the reverse proxy is the best option. In the reverse proxy code, the HttpWebRequest is the means to create each request to the apache server and add the additional authentication headers to it.

.net will deal with encoding the credentials in the proxied request using something like:

RemoteServer remoteServer = new RemoteServer(httpContext);
HttpWebRequest request = remoteServer.GetRequest();
request.PreAuthenticate = true;
request.Credentials = new NetworkCredential(UserName, SecurelyStoredPassword);

回复收藏 0 原文