如何在asp.net windows身份验证中手动验证用户身份
我有一个使用 Windows 身份验证的 Intranet 应用程序。一切正常。然而，对于一些敏感操作（可能是批准 AP 检查，或对学生评分），我需要获取用户的 ID 和密码。目标是防止有人走到无人值守的终端，通常是为了不可否认。对于表单身份验证来说很简单 - 但我不知道如何使用 Windows 身份验证来做到这一点。
我认为这并不重要，但它是 MVC 应用程序，并且身份验证是针对 Active Directory 完成的
I have an Intranet application with Windows Authentication. Everything works fine. However, for some sensitive operations (it could be approving AP check, or grading a student) I need to get user's id and password. The goal is to prevent somebody walking to unattended terminal, and generally for non-repudiation. Trivial with forms authentication - but I can't figure out how to do it with Windows authentication.
I don't think it matters, but it's MVC application and authentication is done against Active Directory
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通常，服务器应用程序需要发出 HTTP 状态代码 401 来告知客户端身份验证信息。但是，在 Windows 身份验证的情况下，一旦用户通过身份验证，令牌就会由客户端系统或浏览器缓存，并在随后需要时使用。因此，在您的情况下，即使您发出 401，客户端也会再次发送相同的令牌 - 因此您滥用无人值守终端的主要问题将不会得到解决（因为用户已经登录到系统中）。
其中一种方法可以是从应用程序模拟表单身份验证 - 即在敏感操作上，再次提示用户输入他/她的 Windows 密码（请注意，如果您使用 Windows 身份验证，您将已经拥有用户的名称（身份）），然后重新- 使用活动目录 API（或登录用户 Windows API）验证该密码。
就个人而言，我觉得您正在尝试解决错误端服务器上的问题 - 我宁愿有一个禁止解锁的无人值守终端的 IT 策略 - 用户应该锁定工作站或使用受密码保护的屏幕保护程序。通常，这些事情可以通过组策略来强制执行。
Typically, server application needs to issue HTTP Status Code 401 to tell client for authentication information. However, in case of windows authentication, once user is authenticated, the token is cached by client system or browser and used subsequently whenever needed. So in your case, even if you issue 401, client will send the same token again - so your main problem of abusing unattended terminal will not get solved (as user already logged in there into the system).
One of the way could be simulate forms authentication from the application - i.e. on sensitive operations, prompt user for his/her windows password again (note that you will be already having user's name(identity) if you are using windows authentication) and then re-validate that password using active directory API (or logon user windows API).
Personally, I feel that you are trying to solve the problem at server which is wrong end - I would rather have a IT policy that prohibits unlocked unattended terminals - either user should lock the workstation or have a password protected screen saver. Typically, these things can be somewhat enforced via group policy.
在我的 webforms 应用程序中，我将一个页面设置为仅允许 Windows Auth 而不允许其他页面，然后获取用户名（因为他们必须已经通过浏览器完成 401 身份验证过程），我得到他们的用户名，如下所示
：然后我可以查询会员提供商以从基础设施获取用户信息。
或者您是否尝试手动执行 401 身份验证过程？
In my webforms app I've got one page set as only allowing Windows Auth and no others, and then to get the username (since they have to have already done the 401 auth procedure via the browser) I get their username like thus:
and then I can query the Membership provider to get the user information from the infrastructure.
Or are you trying to manually do the 401 auth process?