如何使用.Net Core授权AD用户

Question

我正在尝试使用Authorize注释停止路由上的请求,但我无法使用Active Directory.有人有这个工作吗？

[HttpGet]
[Authorize(Roles = "DOMAIN\\Group A")]
[Route("/")] // GET: /
public IActionResult Index()
{
    return View();
}

注意:我也试过了 Authorize(Roles = @"DOMAIN\\Group A")

为了给出一些背景知识,我正在运行Windows,Visual Studio Pro 2015(更新3)

从我的project.json文件中得到一点:

"dependencies": {
    "Microsoft.AspNetCore.Authorization": "1.0.0",
    "Microsoft.AspNetCore.Mvc": "1.0.0",
    "Microsoft.AspNetCore.Server.IISIntegration": "1.0.0",
    "Microsoft.AspNetCore.Server.Kestrel": "1.0.0",
    "Microsoft.Extensions.Configuration.CommandLine": "1.0.0",
    "Microsoft.Extensions.Configuration.EnvironmentVariables": "1.0.0",
    "Microsoft.Extensions.Configuration.FileExtensions": "1.0.0",
    "Microsoft.Extensions.Configuration.Json": "1.0.0",
    "Microsoft.Extensions.Logging": "1.0.0",
    "Microsoft.Extensions.Logging.Console": "1.0.0",
    "Microsoft.Extensions.Logging.Debug": "1.0.0",
    "Microsoft.Extensions.Options.ConfigurationExtensions": "1.0.0",
    "Microsoft.NETCore.App": {
      "version": "1.0.0",
      "type": "platform"
    },
    "Swashbuckle.SwaggerGen": "6.0.0-beta901",
    "Swashbuckle.SwaggerUi": "6.0.0-beta901"
  }

Answer 1

您是否已将IIS和应用程序配置为集成身份验证？

在您的web.config中,您是否通过设置将asp.net核心模块设置为转发Windows身份 forwardWindowsAuthToken="true"

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <handlers>
      <add name="aspNetCore" path="*" verb="*" 
        modules="AspNetCoreModule" resourceType="Unspecified" />
    </handlers>
    <aspNetCore processPath="%LAUNCHER_PATH%" 
      arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" 
      stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" />
  </system.webServer>
</configuration>

在你的program.cs中你有没有与IIS集成.UseIISIntegration()？

var host = new WebHostBuilder()
    .UseKestrel()
    .UseContentRoot(Directory.GetCurrentDirectory())
    .UseIISIntegration()
    .UseStartup<Startup>()
    .Build();

您是否在Startup.cs中的ConfigureServices()方法中添加了授权并将其放在AddMvc()之前？

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthorization();
    services.AddMvc();
}

当我拥有所有这些东西时,我可以根据角色愉快地授权,例如我穿上[Authorize(Roles = "REDMOND\\scottgu_org_fte")]我的家庭控制器,我就可以了.

使用@"REDMOND\\scottgu_org_fte"将无法工作,因为这使得字符串文字逐字逐句,因此它正在尝试评估Domain\\group,并且双斜杠是错误的.@"REDMOND\scottgu_org_fte"会工作的.