四二班班主任
问题描述
我正在开发一个 Intranet 应用程序，并希望使用现有组织的 Active Directory 进行用户身份验证和基于策略的角色授权.
I am developing an intranet application and would like to use the existing organisations Active Directory for user authentication and policy based role authorisation.
有人能指出我正确的方向吗?我有点困惑(实际上很困惑).
Can someone point me in the right direction? I am getting a bit confused (well actually a lot confused).
谢谢
推荐答案
http://docs.asp.net/en/latest/security/index.html
首先启动一个新的 ASP.Net Web 应用程序项目，选择 Web 应用程序模板，然后在右侧窗格中按更改身份验证"按钮并选择Windows 身份验证".
First start a new ASP.Net Web Application project, Pick the Web Application template then on the right pane press the "Change Authentication" button and pick "Windows Authentication".
您现在可以在类或方法上使用 [Authorize] 来检查基本身份验证与 RC2 的活动目录，您可以简单地使用组名称 ala [Authorize(Roles=@"域组")]
You can now use [Authorize] on a class or method to check basic authentication vs active directory as of RC2 you can simply use the group names ala [Authorize(Roles=@"DOMAINGROUP")]
现在已经过时且繁琐的替代方案(仍然有效):
The now obsolete and cumbersome alternative (still works):
如果您查看 User.Claims，您可以看到每个用户组的 groupid 键.在此基础上，您可以执行诸如 [Authorize(Policy="FOOBAR")] 之类的操作，并通过
If you look at User.Claims you can see the groupsid keys exist for each of the user's groups. Building off that you can do something like [Authorize(Policy="FOOBAR")] and define it in your Startup.ConfigureServices method via
services.AddAuthorization(
o => o.AddPolicy(
"FOOBAR",
p => p.RequireClaim("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
"ENTER GROUP SID")
));
请注意，RequireClaim 的第二个参数是一个字符串数组，以允许多个组.
Note that the second param to RequireClaim is a string array to allow for multiple groups.
还要注意通过这个命令行魔法找出组ID dsquery group -name ENTER GROUP NAME" |dsget 组 -sid
Also note to figure out group ids via this command line magic dsquery group -name "ENTER GROUP NAME" | dsget group -sid
