在asp.net中使用混合模式身份验证时如何配置IIS7

Question

以下帖子显示如何使用混合模式身份验证为站点设置web.config.IIS7混合模式身份验证以及如何在IIS 7.0中允许混合模式身份验证.

我有我的网站设置和本地工作(在我的开发人员机器上).但是,当我在服务器上本地运行它时,我得到401.2 - 由于服务器配置错误,登录失败.

任何人都知道我应该如何配置服务器,默认网站和我的网站？

编辑:以下是我的web.config中的设置,包括来自Forms身份验证节点的loginUrl.

    <location path="~/Account/WinLogin.aspx">
    <system.web>
      <authorization>
        <deny users="?"/>
        <allow users="*"/>
      </authorization>
    </system.web>
    <system.webServer>
      <security>
        <authentication>
          <anonymousAuthentication enabled="false"/>
          <windowsAuthentication enabled="true"/>
        </authentication>
      </security>
    </system.webServer>
  </location>
  <system.web>
    <authentication mode="Forms">
      <forms loginUrl="~/Account/WinLogin.aspx" timeout="60"/>
    </authentication>
    <authorization>
      <deny users="?"/>
    </authorization>

Answer 1

让我们从服务器角色配置开始(这是在服务器管理器,角色,IIS下)

您将要确保启用/安装Windows身份验证和匿名身份验证部分,以及表单身份验证(可能您已经拥有).安装/配置后,您需要定义以下内容:

在您的Web.Config中,您将要定义以下部分:

<configuration>
  <system.web>
  <authentication mode="Forms">
      <forms cookieless="UseDeviceProfile" defaultUrl="~/Default.aspx" enableCrossAppRedirects="true" loginUrl="~/WindowsLogin.aspx" name=".ASPXAUTH" path="/" protection="All" requireSSL="false" slidingExpiration="true" timeout="10080"/>
    </authentication>
    <authorization>
        <deny users="?"/>
    </authorization>
  </system.web>
  <location path="Login.aspx">
      <system.web>
          <authorization>
              <allow users="?"/>
          </authorization>
      </system.web>
      <system.webServer>
          <security>
              <authentication>
                  <anonymousAuthentication enabled="true"/>
                  <windowsAuthentication enabled="false"/>
              </authentication>
          </security>
      </system.webServer>
  </location>
  <location path="WindowsLogin.aspx">
      <system.web>
          <authorization>
              <deny users="?"/>
              <allow users="*"/>
          </authorization>
      </system.web>
      <system.webServer>
          <security>
              <authentication>
                  <anonymousAuthentication enabled="false"/>
                  <windowsAuthentication enabled="true"/>
              </authentication>
          </security>
      </system.webServer>
  </location>
</configuration>

然后你需要两个文件:

Login.aspx (this does forms auth)
WindowsLogin.aspx (this does Windows auth)

LOGIN表单是正确的,所以这只是bog标准的ASP.NET表单auth它的WindowsLogin可以实现魔术(这里是那个文件)

using System;
using System.Web;
using System.Web.Security;
using App_Code.Biz;

public partial class WindowsLogin : System.Web.UI.Page {
    protected string UserIsInRoles = string.Empty;
    private static readonly BAL _mBAL = new BAL();
    protected void Page_Load(object sender, EventArgs e) {
        string redirectUrl = Request["returnurl"] ?? "~/default.aspx";
        string username = Request.ServerVariables["LOGON_USER"];
        try {
            if ( Roles.GetRolesForUser( username ).Length < 1 )
                Roles.AddUserToRole( username, Global.defaultRole );
            int status;
            _mBAL.aspnet_Membership_CreateUser( username, out status );
        } catch ( Exception ex ) {
            ErrHandler.WriteXML( ex );
        }

        /* Test to see if the user is in any roles */
        if ( Roles.GetRolesForUser( username ).Length < 1 ) {
            UserIsInRoles = "<br />" + username + "You are not in any rules. This must be your first visit to our site!<br /> Adding you to the " + Global.defaultRole + " role now!";

        } else {
            UserIsInRoles = "You are in the following roles: ";
            string[] roles = Roles.GetRolesForUser( username );
            foreach ( string role in roles )
                UserIsInRoles += role + ", ";
            UserIsInRoles = UserIsInRoles.Remove( UserIsInRoles.Length - 2 ) + "!";

            if ( Login( username, String.Join( ",", roles ) ) )
                Response.Redirect( redirectUrl );
        }

        //we shouldn't get here, so if we do, redirect back to a page they can use.
        if ( Page.IsPostBack ) {
            if ( Response.StatusCode == 401 )
                Response.Redirect( "~/Login.aspx" );

        }
    }

    private bool Login(string strUser, string strRole) {
        if ( strRole != null ) {
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
               1,                            // version
               strUser,                      // user name
               DateTime.Now,                 // create time
               DateTime.Now.AddYears(1),     // expire time
               false,                        // persistent
               strRole );                     // user data
            string strEncryptedTicket = FormsAuthentication.Encrypt( ticket );
            HttpCookie cookie = new HttpCookie( FormsAuthentication.FormsCookieName, strEncryptedTicket );
            Context.Response.Cookies.Add( cookie );
            return true;
        }
        return false;
    }
}

完成所有这些后,您可能会在父级别锁定部分时遇到配置错误.锁或者是默认设置的(overrideModeDefault ="拒绝")或位置标记明确设置......如果是这样,那么解决的最快方法是打开C:\ WINDOWS\SYSTEM32\INETSRV \设置\的applicationHost.config并编辑以下块:

<configSections>
  <sectionGroup name="system.webServer">
    <sectionGroup name="security">
      <sectionGroup name="authentication">
        <section name="anonymousAuthentication" overrideModeDefault="Allow">
        <section name="windowsAuthentication" overrideModeDefault="Allow">
      </sectionGroup>
    </sectionGroup>
  </sectionGroup>
</configSections>

另请参阅聊天记录:http://chat.stackoverflow.com/rooms/5/conversation/configuring-iis7-and-mixed-mode-authentication-in-asp-net