c# - PrincipalContext.ValidateCredentials 为空密码返回 true 是什么？

Question

我们的应用程序有一个登录框，要求用户输入他们的 AD 凭据。我们获取这些凭据，然后调用

    using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, domain, container, ContextOptions.SimpleBind))
    {
        return pc.ValidateCredentials(domain + @"\" + username, password, ContextOptions.SimpleBind);
    }

验证他们是否输入了有效的登录名/密码对。但我们发现，对 ValidateCredentials 的调用将返回 true 和空白密码，我们不知道为什么。无效的密码返回false，但是只要用户名正确，空白就会返回true。

Answer 1

来自 MSDN http://msdn.microsoft.com/en-us/library/bb154889.aspx

The ValidateCredentials method binds to the server specified in the constructor. If the username and password parameters are null, the credentials specified in the constructor are validated. If no credential were specified in the constructor, and the username and password parameters are null, this method validates the default credentials for the current principal.

在 PrincipalContext 构造函数中，您还可以指定要检查的凭据。

using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, domain, 
                       container, ContextOptions.SimpleBind, username, password))
{
    return pc.ValidateCredentials(domain + @"\" + username, password,
                                   ContextOptions.SimpleBind);
}