IIS 部署在 cassini 中正常工作后，PrincipalContext.ValidateCredentials 停止验证

发布于 2024-12-15 22:13:28 字数 974 浏览 1 评论 0原文

我有以下代码片段来测试 AD 的纯文本用户名/密码，如果我在 Visual Studio 中按 F5 并通过 WCFTestClient 尝试它，效果很好，但是一旦我部署到 IIS 并尝试相同的功能，它就会ValidCredentials 永远不会返回 true；是否需要为应用程序池运行的身份设置一些安全方面的信息？

我尝试将应用程序池身份设置为我自己的帐户（域管理员）只是为了测试这是否是问题所在，但这也没有帮助，所以我对如何解决这个问题有点迷失。

该网站（自定义 API）设置了匿名访问。

try
{
    // create a "principal context" - e.g. your domain (could be machine, too) 
    using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, DomainName))
    {
        // validate the credentials
        if (pc.ValidateCredentials(UserName, Password))
        {
            IsValid = true;
            break;
        }
    }
}
catch (Exception)
{
    LoggingControler.LogWarning(null, "Unreachable Domain: " + Domain);
}

我又回顾了一遍，这一切都归功于Windows中的权利。网络服务不知何故没有足够的权限来执行 PrincipalContext.ValidateCredentials。如果我将应用程序池标识更改为域管理员的标识，则代码可以正常工作。

如果有人可以告诉我如何设置一个具有适当权限的受限用户帐户来执行 PrincipalContext.ValidateCredentials，我就可以完成此任务。

原文

I have the following code snippet to test a plain-text username/password against the AD, which works fine if I hit F5 in visual studio and try it via the WCFTestClient, but once I deploy to IIS and try the same function, it will never return true for ValidCredentials; is there something security wise that needs to be set for the Identity that the Application Pool runs under?

I tried setting the App Pool identity to my own account (domain admin) just to test if this was the problem, but that didn't help either, so I'm a bit lost as to how to fix this.

The site (Custom API) has anonymous access set up.

try
{
    // create a "principal context" - e.g. your domain (could be machine, too) 
    using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, DomainName))
    {
        // validate the credentials
        if (pc.ValidateCredentials(UserName, Password))
        {
            IsValid = true;
            break;
        }
    }
}
catch (Exception)
{
    LoggingControler.LogWarning(null, "Unreachable Domain: " + Domain);
}

I've gone over things again, and it's all due to Rights in Windows. Network Service somehow doesn't have enough rights to execute PrincipalContext.ValidateCredentials. If I change the Application Pool Identity to the identity of a Domain Administrator, the code works.

If someone can tell me how to set up a Limited User account with the proper rights to execute PrincipalContext.ValidateCredentials, I can finish this.

分享到QQ

分享到微博