如何从收到的 msmq 消息中获取发件人的 WindowsIdentity?

发布于 2024-12-12 19:41:09 字数 549 浏览 0 评论 0原文

如何从收到的 msmq 消息中获取发件人的 WindowsIdentity?

我使用 msmq 作为传输和带有授权规则提供程序的安全应用程序块来进行操作授权。我需要 WindowsPrincipal 而不是 GenericPrincipal,因为规则授予 Active Directory 用户组而不是特定用户。 Message.SenderId 可以转换为 SecurityIdentifier,但我没有找到如何从中获取 WindowsIdentity。

void AuthorizeOperation(Message message)
{
   // get sender windows principal
   WindowsPrincipal principal = ... ???

   // extract operation name from message body
   string operation = ... 

   AuthorizationFactory.GetAuthorizationProvider().Authorize(principal, operation);
}

How to get sender's WindowsIdentity from recieved msmq message?

I use msmq as a transport and a Security Appplication Block with Authorization Rule Provider for operation's authorization. I need WindowsPrincipal and not GenericPrincipal because rules granted to active directory user's groups and not to specific users.
Message.SenderId can be converted to SecurityIdentifier but I did not find how to get WindowsIdentity from it.

void AuthorizeOperation(Message message)
{
   // get sender windows principal
   WindowsPrincipal principal = ... ???

   // extract operation name from message body
   string operation = ... 

   AuthorizationFactory.GetAuthorizationProvider().Authorize(principal, operation);
}

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

你与清晨阳光 2024-12-19 19:41:10

我找到了解决方法,但不确定它是否是正确的解决方案。
我创建了一个 GenericPrincipal 并注入从 Active Directory 接收的用户授权组,而不是 WindowsPrincipal。

var sid = new SecurityIdentifier(message.SenderId, 0);
var user = UserPrincipal.FindByIdentity(new PrincipalContext(ContextType.Domain), IdentityType.Sid, sid);
var principal = new GenericPrincipal(
                   new GenericIdentity(user.SamAccountName),
                   user.GetAuthorizationGroups().Select(g => g.SamAccountName).ToArray());
bool authorized = AuthorizationFactory.GetAuthorizationProvider().Authorize(principal, operation);

I have found a workaround but not sure that it is a right solution.
Instead of WindowsPrincipal I create a GenericPrincipal and inject user's authorization groups recieved from active directory.

var sid = new SecurityIdentifier(message.SenderId, 0);
var user = UserPrincipal.FindByIdentity(new PrincipalContext(ContextType.Domain), IdentityType.Sid, sid);
var principal = new GenericPrincipal(
                   new GenericIdentity(user.SamAccountName),
                   user.GetAuthorizationGroups().Select(g => g.SamAccountName).ToArray());
bool authorized = AuthorizationFactory.GetAuthorizationProvider().Authorize(principal, operation);
~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文