ASP.NET Core 2.0 LDAP Active Directory身份验证

Question

我从过去发现了很多信息,说LDAP身份验证尚未启用,但您可以使用第三方软件包解决这个问题. 但是,似乎在1月份实施了LDAP身份验证WAS .我似乎无法找到任何关于如何实现它的信息.

我已经在我的项目中设置了自定义身份验证,我只需要逻辑来填写HandleAuthenticateAsync方法.

我尝试过使用其他示例,但它们似乎不适用于.NET Core 2.0.

这是我能想到的唯一相关代码

protected override Task<AuthenticateResult> HandleAuthenticateAsync()
{
    // Get Authorization header value
    if (!Request.Headers.TryGetValue(HeaderNames.Authorization, out var authorization)) {
        return Task.FromResult(AuthenticateResult.Fail("Cannot read authorization header."));
    }

    // TODO: Authenticate user

    // Create authenticated user ticket
    var identities = new List<ClaimsIdentity> { new ClaimsIdentity("custom auth type") };
    var ticket = new AuthenticationTicket(new ClaimsPrincipal(identities), Options.Scheme);

    return Task.FromResult(AuthenticateResult.Success(ticket));

    // else User not authenticated
    return Task.FromResult(AuthenticateResult.Fail("Invalid auth key."));
}

所以,我的问题是,如何在.NET Core 2.0中实现LDAP身份验证？

Answer 1

感谢Win的答案指出我需要使用Windows兼容包,我能够弄明白这一点.

我要做的第一件事就是安装Nuget包

Install-Package Microsoft.Windows.Compatibility 

那时,我需要一个预览版本,所以我附加-Version 2.0.0-preview1-26216-02在这个命令的末尾

然后,为System.DirectoryServices和添加using语句System.DirectoryServices.AccountManagement

然后,只需将此逻辑插入我的HandleAuthenticateAsync方法:

const string LDAP_PATH = "EX://exldap.example.com:5555";
const string LDAP_DOMAIN = "exldap.example.com:5555";

using (var context = new PrincipalContext(ContextType.Domain, LDAP_DOMAIN, "service_acct_user", "service_acct_pswd")) {
    if (context.ValidateCredentials(username, password)) {
        using (var de = new DirectoryEntry(LDAP_PATH))
        using (var ds = new DirectorySearcher(de)) {
            // other logic to verify user has correct permissions

            // User authenticated and authorized
            var identities = new List<ClaimsIdentity> { new ClaimsIdentity("custom auth type") };
            var ticket = new AuthenticationTicket(new ClaimsPrincipal(identities), Options.Scheme);
            return Task.FromResult(AuthenticateResult.Success(ticket));
        }
    }
}

// User not authenticated
return Task.FromResult(AuthenticateResult.Fail("Invalid auth key."));

Answer 2

根据#2089,它仅适用于.NET内核的Windows兼容包.我目前使用Novell.Directory.Ldap.NETStandard.

public bool ValidateUser(string domainName, string username, string password)
{
   string userDn = $"{username}@{domainName}";
   try
   {
      using (var connection = new LdapConnection {SecureSocketLayer = false})
      {
         connection.Connect(domainName, LdapConnection.DEFAULT_PORT);
         connection.Bind(userDn, password);
         if (connection.Bound)
            return true;
      }
   }
   catch (LdapException ex)
   {
      // Log exception
   }
   return false;
}

对于身份验证和授权,我们可以使用Cookie身份验证中间件 和声明.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, 
   ILoggerFactory loggerFactory)
{
   app.UseCookieAuthentication(new CookieAuthenticationOptions
   {                
      AuthenticationScheme = "AuthenticationScheme",
      LoginPath = new PathString("/Account/Login"),
      AccessDeniedPath = new PathString("/Common/AccessDenied"),
      AutomaticAuthenticate = true,
      AutomaticChallenge = true
   });
}

它的移动件很少,所以我在GitHub上创建了一个工作示例项目.有两个主要部分- LdapAuthenticationService和SignInManager.