c# - 如何在 Nancy 中针对 Active Directory 进行身份验证？

Question

这是一篇过时的文章，但是http://msdn.microsoft.com/en-us/library/ff650308.aspx#paght000026_step3说明我想做什么。我选择了Nancy作为我的 Web 框架，因为它的简单性和低仪式性的方法。因此，我需要一种使用 Nancy 对 Active Directory 进行身份验证的方法.

在 ASP.NET 中，看起来您只需通过 web.config 文件中的一些设置即可在基于数据库的成员资格提供程序和 Active Directory 之间切换。我并不特别需要它，但在开发和生产之间切换的能力将是惊人的。

如何做到这一点？

Answer 1

实际上，解决方案比看起来要简单得多。只需将 Active Directory 视为用户的存储库(就像数据库一样)。您需要做的就是查询 AD 以验证输入的用户名和密码是否有效。因此，只需使用 Nancy 的表单验证并在 IUserMapper 的实现中处理与 AD 的连接。这是我为我的用户映射器想出的:

public class ActiveDirectoryUserMapper : IUserMapper, IUserLoginManager
{
    static readonly Dictionary<Guid, long> LoggedInUserIds = new Dictionary<Guid, long>(); 

    readonly IAdminUserValidator _adminUserValidator;
    readonly IAdminUserFetcher _adminUserFetcher;
    readonly ISessionContainer _sessionContainer;

    public ActiveDirectoryUserMapper(IAdminUserValidator adminUserValidator, IAdminUserFetcher adminUserFetcher, ISessionContainer sessionContainer)
    {
        _adminUserValidator = adminUserValidator;
        _adminUserFetcher = adminUserFetcher;
        _sessionContainer = sessionContainer;
    }

    public IUserIdentity GetUserFromIdentifier(Guid identifier, NancyContext context)
    {
        _sessionContainer.OpenSession();
        var adminUserId = LoggedInUserIds.First(x => x.Key == identifier).Value;
        var adminUser = _adminUserFetcher.GetAdminUser(adminUserId);
        return new ApiUserIdentity(adminUser);
    }

    public Guid Login(string username, string clearTextPassword, string domain)
    {
        var adminUser = _adminUserValidator.ValidateAndReturnAdminUser(username, clearTextPassword, domain);
        var identifier = Guid.NewGuid();
        LoggedInUserIds.Add(identifier, adminUser.Id);
        return identifier;
    }
}

我在我的数据库中保留了一条记录来处理角色，因此此类处理使用 AD 进行验证并从数据库中获取用户:

public class AdminUserValidator : IAdminUserValidator
{
    readonly IActiveDirectoryUserValidator _activeDirectoryUserValidator;
    readonly IAdminUserFetcher _adminUserFetcher;

    public AdminUserValidator(IAdminUserFetcher adminUserFetcher,
                              IActiveDirectoryUserValidator activeDirectoryUserValidator)
    {
        _adminUserFetcher = adminUserFetcher;
        _activeDirectoryUserValidator = activeDirectoryUserValidator;
    }

    #region IAdminUserValidator Members

    public AdminUser ValidateAndReturnAdminUser(string username, string clearTextPassword, string domain)
    {
        _activeDirectoryUserValidator.Validate(username, clearTextPassword, domain);

        return _adminUserFetcher.GetAdminUser(1);            
    }

    #endregion
}

并且这个类实际上验证用户名/密码组合是否存在于 Active Directory 中:

public class ActiveDirectoryUserValidator : IActiveDirectoryUserValidator
{
    public void Validate(string username, string clearTextPassword, string domain)
    {
        using (var principalContext = new PrincipalContext(ContextType.Domain, domain))
        {
            // validate the credentials
            bool isValid = principalContext.ValidateCredentials(username, clearTextPassword);
            if (!isValid)
                throw new Exception("Invalid username or password.");
        }

    }
}