IIS 中通过 https 的匿名身份验证不会触发回发
我最近决定将内部 Web 应用程序使用 Windows 身份验证更改为表单身份验证。我不太使用后者，一个网站解释说，您必须同时启用“表单”和“匿名”才能正常工作。这个想法是根据活动目录验证用户密码，然后授予他们相应的访问权限。我在本地运行得很好，当发布到 IIS 7.5 时它仍然有效。这只是一个基本的 Visual Studio 项目，会重定向到我们的主页。
当我尝试使用 https 安全地访问同一个项目时，出现了问题，我包含了完整的域，它会加载新的登录页面，但当我单击登录时，它不会执行任何操作。从那时起，我在网上搜索并发现了许多这样那样的提及，并且尝试了其中许多都无济于事。
直到后来我才创建了一个空白项目，其中包含一个按钮和页面上的一行代码，以查看回发是否已触发。发布后，我仅在 IIS 中启用了匿名身份验证，并在单击按钮时使用 http 浏览到此基本测试应用程序，页面上的 false 更改为 true - 表示回发。然而对于 https 来说，它仍然是错误的。我认为这可能就是活动目录登录无法正常工作的原因，因为它也启用了匿名。
我在安全方面仍然很陌生，但随着详细信息的传递，我必须使用安全连接来登录，然后它可以重定向到我们内部使用的常用应用程序。
如果您对此有任何想法，我将不胜感激。
谢谢！
I recently decided to change from using Windows Authentication for my internal web applications to Forms Authentication. I've not used the latter very much and one site explained you have to enable both Forms and Anonymous for this to work. The idea is to verify user passwords against an active directory then grant them access accordingly. I had this working just fine locally and when publishing to IIS 7.5 it still worked. It was just a basic Visual Studio project that would redirect to our homepage.
The problems arose when I tried accessing this same project securely with https, I included the full domain and it would load the new login page but when I clicked login it would do nothing. Since then I've scoured the web and found numerous mentions of this and that and tried many of them to no avail.
It was only later I created a blank project with a single button and one line of the code on the page to see if a post back had fired. After publishing I only enabled Anonymous Authentication in IIS and browsing to this basic test app using http when you clicked the button, false on the page changed to true - indicating a post back. Yet with https it just remains false. I think this may be why the active directory login wasn't working as it too had Anonymous enabled.
I'm still pretty new at the secure side of things but with the details passing over I have to use a secure connection just for the login then it can redirect to the usual applications we use internally.
I'd appreciate any thoughts you may have regarding this.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我们一直成功地使用此配置（匿名 IIS 访问、表单身份验证和 https）。
您应该执行三件事来跟踪此问题：
1) 验证页面中是否存在破坏按钮的 JavaScript 错误（即 JavaScript 文件未传递到页面）
2) 检查 Windows 事件日志中是否存在asp.net/iis 的例外情况。
3) 安装并运行fiddler，从
中选择菜单，单击Fiddler Options...工具HTTPS选项卡并确保选中所有复选框，然后运行您的网站并查看请求和响应，特别是当您按下按钮时。We use this configuration (anonymous IIS access, forms authentication, and https) successfully all of the time.
There are three things that you should do to track this issue down:
1) Verify that there are no javascript errors in the page that break the button (i.e. a javascript file not being delivered to the page)
2) Check the windows event logs for exceptions from asp.net/iis.
3) Install and run fiddler, select
Fiddler Options...from theToolsmenu, click on theHTTPStab and ensure all of the checkboxes are checked, then run your website and look at the requests and responses, particularly when you press the button.