Cassini忽略Win NT角色授权，IIS 7.5一切正常

发布于 2024-12-03 16:35:54 字数 1416 浏览 1 评论 0原文

我有一个 ASP.NET MVC 3 应用程序在我的本地开发盒 (Win7) 和登台服务器 (W2k8r2) 上运行。在启用 ASP.NET Windows 授权安全性之前，应用程序在两种环境中都运行良好。

保护 Web 应用程序后，它继续在临时服务器上正常运行，但在我的本地开发盒上生成 401.2 访问被拒绝。我能看到的唯一显着差异是在本地开发盒上，我通过 Visual Studio 使用 Cassini，而服务器是 IIS7.5。

正在使用Windows授权+模拟。什么可能导致 Cassini 生成这些 401.2 访问被拒绝？

Web.config 是：

<system.web>
   <authentication mode="Windows" />
   <identity impersonate="true" />
   <!-- replication of system.webServer security settings for cassini which doesn't process them... -->
   <authorization>
       <allow roles=".\Test Application - Users" />
       <deny users="*" />
   </authorization>
</system.web>
<system.webServer>
   <validation validateIntegratedModeConfiguration="false" />
   <modules runAllManagedModulesForAllRequests="true" />
   <security>
      <authorization>
          <remove users="*" roles="" verbs="" />
          <add accessType="Allow" users="" roles="Test Application - Users" />
      </authorization>
  </security>

仅供参考，相关用户位于每个系统上的“测试应用程序 - 用户”Windows 安全组中。

解决方案

开发盒上的根本问题是：

Cassini 不支持身份模拟并且
而用户已被添加到相关的 NT 组，他们没有注销/登录，因此与他们的 Windows 令牌关联的组 SID 没有被刷新

如果 Cassini 支持模拟，我怀疑这会是一个问题，因为会在冒充语境。感谢@x0n 指出了正确的方向。

原文

I have an ASP.NET MVC 3 application running on both my local dev box (Win7) and staging server (W2k8r2). The application operates fine in both environments until ASP.NET Windows authorization security is enabled.

After securing the web-app, it continues operates correctly on the staging server but generates 401.2 access denied's on my local dev box. The only significant difference I can see is on local dev box, I'm using Cassini via Visual Studio whereas the server is IIS7.5.

Windows authorization + impersonation is being used. What could cause Cassini to generate these 401.2 access denied?

Web.config is:

<system.web>
   <authentication mode="Windows" />
   <identity impersonate="true" />
   <!-- replication of system.webServer security settings for cassini which doesn't process them... -->
   <authorization>
       <allow roles=".\Test Application - Users" />
       <deny users="*" />
   </authorization>
</system.web>
<system.webServer>
   <validation validateIntegratedModeConfiguration="false" />
   <modules runAllManagedModulesForAllRequests="true" />
   <security>
      <authorization>
          <remove users="*" roles="" verbs="" />
          <add accessType="Allow" users="" roles="Test Application - Users" />
      </authorization>
  </security>

FYI Relevant users are in the 'Test Application - Users' Windows security group on each system.

Solution

The underlying issue on the dev box turned out to be that:

Cassini doesn't support identity impersonation and
Whilst the user had been added to relevant NT groups, they had not logged off/on and thus the group SID's associated with their Windows token had not been refreshed

If impersonation had been supported by Cassini I doubt this would have been an issue because a new token would have been established within the impersonation context. Thanks to @x0n for pointing in the right direction.

分享到QQ

分享到微博