UWP - 在 ADAL 身份验证中启用专用网络
我们正在使用 Xamarin 表单创建一个 UWP 应用，出于登录目的，已使用 ADAL。当我们连接到 VPN 时，身份验证已成功进行。但是，当我们尝试在不需要 VPN 的客户端网络中运行相同的应用程序时，应用程序不会显示 ADAL IWA（集成 Windows 身份验证），而是收到错误消息“我们无法连接到服务”你现在就需要。请检查您的网络连接或稍后重试。”我附上了一张图片供参考。经过进一步调查，我们在 Microsoft 论坛 (https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-net-uwp-considerations）。解决方案是在 HKEY_LOCAL_MACHINE 中的 Authhost.exe 的注册表编辑器中启用专用网络。运行以下命令后，我们可以绕过该问题。但我们不想在每台最终用户计算机或设备上编辑注册表。因此，我们尝试在应用程序内以编程方式编辑注册表，但出现安全异常。
通过命令提示符启用专用网络：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image 文件执行选项\authhost.exe\EnablePrivateNetwork = 00000001
尝试以编程方式编辑注册表时出错：
System.Security.SecurityException: '请求的注册表访问权限不是 允许。'
以编程方式编辑注册表的参考：
https://codingvision.net/c-edit -registry-keys-or-values
那么，我们需要了解，解决这个问题的最佳方法是什么？
我不想使用命令提示符或 注册表编辑器应用程序。
是否可以通过 AD 组策略或 Windows 操作系统设置启用专用网络。
启用专用网络的任何其他可能的方式
注意： 相同的代码在 Android 环境中运行良好。问题仅出现在 Windows 上。
We are creating a UWP app using Xamarin forms and for Login purposes, ADAL has been used. Authentication has been happening successfully when we are connected to VPN. But when we try to run the same app in the Client network where we don’t require VPN, App is not showing ADAL IWA (Integrated Windows Authentication), instead, we are getting the Error message “We can't connect to the service you need right now. Check your network connection or try this again later.” I have attached an image for reference. On investigating further, we found an article about the same issue with the solution in the Microsoft forum (https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-net-uwp-considerations). The solution is to enable the Private Network in the Registry Editor in Authhost.exe in HKEY_LOCAL_MACHINE. On running the below command, we could be able to bypass the issue. But we don’t want to play on editing the registry on each end-user machine or device. So, we tried editing the registry programmatically inside the app, but we got a security exception.
Enabling Private Network Through Command Prompt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\authhost.exe\EnablePrivateNetwork = 00000001
Error while trying to edit Registry Programmatically:
System.Security.SecurityException: 'Requested registry access is not
allowed.'
Reference for Editing Registry Programmatically:
https://codingvision.net/c-edit-registry-keys-or-values
So, we need to understand, what is the best way to address this issue?
I don't want to alter the Registry using the command prompt or
Registry Editor App.Is it possible to enable private network via AD group policy or Windows OS Settings.
Any other possible way to Enable Private Network
Note:
The same code works fine with Android Environment. The problem is only with Windows.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
• 不存在可以在 ADAL 身份验证中更改专用网络注册表中的此选项的组策略。但您当然可以通过组策略更改此注册表设置，因为它是启用专用网络进行 ADAL 身份验证的唯一解决方案。为此，请按照组策略中的以下步骤操作： -
a) 登录组策略服务器/域控制器并打开组策略管理 GUI，然后选择默认域组策略并进行编辑。
b) 然后转到“计算机配置-->”首选项-> Windows 设置 -->注册表-->新-->注册表向导”。注册表向导将打开并允许您连接到远程计算机并选择适当的注册表项，即'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\authhost.exe\EnablePrivateNetwork = 00000001'
c) 选择系统中存在上述注册表项的正确客户端系统，然后选择它。另请注意，注册表浏览器允许您从配置单元中选择注册表项'HKEY_LOCAL_MACHINE'和'HKEY_USERS'。另外，如果远程系统无法从注册表查找器连接，请确保系统已打开，访问未被防火墙阻止，并且远程注册表服务未停止。
d) 完成后，上述注册表项将连同工作区中该注册表项的所需路径一起导入到组策略控制台中。完成后，应部署 GPO，这样，注册表项将在该域网络中的所有客户端系统上推送和更新。
• 如果您不想将其部署到所有域网络，则在部署此注册表项时，您必须创建一个新的组策略对象并从组策略服务器中选择适当的 OU。
• There is no group policy existent which changes this option in registry for the private network in ADAL authentication. But you surely can change this registry setting through group policy as it is the only solution to enable private network for ADAL authentication. To do this, please follow the steps below in group policy: -
a) Login to the Group policy server/domain controller and open the group policy management GUI, then select the default domain group policy and edit it.
b) Then go to ‘Computer Configuration --> Preferences-> Windows settings --> Registry --> New --> Registry Wizard’. The registry wizard opens and allows you to connect to the remote computer and select the appropriate registry key, i.e., ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\authhost.exe\EnablePrivateNetwork = 00000001’
c) Select the correct client system that has the above registry entry present in their system and then select it. Also, please note that the registry browser allows you to select the keys from the hives ‘HKEY_LOCAL_MACHINE’ and ‘HKEY_USERS’ only. Also, if the remote system is unable to connect from the registry finder, please ensure that the system is turned on, access is not blocked by firewall and the remote registry service is not stopped.
d) Once done, the above registry entry is imported into the Group policy console along with the desired path for that registry key in the workspace. Once done, the GPO should be deployed and, in this way, the registry key will be pushed and updated on all the client systems in that domain network.
• You will have to create a new Group policy object and select the appropriate OU from the Group policy server while deploying this registry key if you do not want to deploy it to all the domain networks.