c# - 在经典云服务中可以使用 ActiveDirectoryMembershipProvider，但不能在 Azure Web App 上使用

Question

我们在 .NET 4.7.2 上有一个可用的 ASP.Net Web 应用程序(.NET Framework 而非 Core)，已部署到经典云服务。我们正在尝试将其部署到 Azure 应用服务。到目前为止，大多数现有功能都运行良好。不幸的是，我们在将 ActiveDirectoryMembershipProvider 作为 FormsAuthentication 工作的一部分时遇到了问题。

我们的 LDAP 托管在 AWS 中，可以通过 IP 地址进行访问。出于调试目的，我们在不安全的 LDAP(端口 389)上尝试它。我们可以从机器访问 LDAP，我们可以获得测试 LDAP 用户的组成员身份。但是，使用内置的 ActiveDirectoryMembershipProvider 我们收到以下错误

Exception type  System.Configuration.ConfigurationErrorsException
Exception message   Access is denied.
 (D:\home\site\wwwroot\web.config line 242) <--- Access is denied.
System.Configuration.ConfigurationErrorsException: Access is denied.
 (D:\home\site\wwwroot\web.config line 242) ---> System.UnauthorizedAccessException: Access is denied.

   at System.DirectoryServices.ActiveDirectory.DirectoryContext.IsContextValid(DirectoryContext context, DirectoryContextType contextType)
   at System.DirectoryServices.ActiveDirectory.DirectoryContext.isDomain()
   at System.DirectoryServices.ActiveDirectory.Domain.GetDomain(DirectoryContext context)
   at System.Web.Security.DirectoryInformation.InitializeDomainAndForestName()
   at System.Web.Security.ActiveDirectoryMembershipProvider.Initialize(String name, NameValueCollection config)
   at System.Web.Configuration.ProvidersHelper.InstantiateProvider(ProviderSettings providerSettings, Type providerType)
   --- End of inner exception stack trace ---
   at System.Web.Configuration.ProvidersHelper.InstantiateProvider(ProviderSettings providerSettings, Type providerType)
   at System.Web.Configuration.ProvidersHelper.InstantiateProviders(ProviderSettingsCollection configProviders, ProviderCollection providers, Type providerType)
   at System.Web.Security.Membership.InitializeSettings(Boolean initializeGeneralSettings, RuntimeConfig appConfig, MembershipSection settings)
   at System.Web.Security.Membership.Initialize()
   at System.Web.Security.Membership.get_Provider()
   at System.Web.Security.Membership.ValidateUser(String username, String password)
   at <ASPX METHOD>:.ValidateUser(String username, String password) in <ASPX CODEBEHIND>:line 56
   at <ASPX METHOD>(Object sender, EventArgs e) in <ASPX CODEBEHIND>::line 26
   at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
   at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)
   at System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at ASP.<ASPX CODEBEHIND>:.ProcessRequest(HttpContext context) in d:\local\Temporary ASP.NET Files\root\0a1c09b7\daf71945\App_Web_ahzd2zi1.4.cs:line 0
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.<>c__DisplayClass285_0.<ExecuteStepImpl>b__0()
   at System.Web.HttpApplication.StepInvoker.Invoke(Action executionStep)
   at System.Web.HttpApplication.StepInvoker.<>c__DisplayClass4_0.<Invoke>b__0()
   at Microsoft.AspNet.TelemetryCorrelation.TelemetryCorrelationHttpModule.OnExecuteRequestStep(HttpContextBase context, Action step)
   at System.Web.HttpApplication.<>c__DisplayClass284_0.<OnExecuteRequestStep>b__0(Action nextStepAction)
   at System.Web.HttpApplication.StepInvoker.Invoke(Action executionStep)
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

成员(member)配置如下

<membership defaultProvider="MyADMembershipProvider">
    <providers>
        <clear />
        <add name="MyADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName" connectionUsername="<DOMAIN>\<USERNAME>" connectionPassword="<PASSWORD>" />
    </providers>
</membership>

连接字符串是

<add name="ADConnectionString" connectionString="LDAP://<IPADDRESS>:<PORT>/DC=<DOMAIN>,DC=local" />

似乎找不到任何表明在 Azure 中运行它的不同内容的内容。任何见解都值得赞赏。

Answer 1

Azure 应用服务不适用于 Active Directory。您可能想探索 Azure Active Directory。

LDAP 不能直接在云上运行。您必须使用 Azure AD 域服务 - https://learn.microsoft.com/en-us/azure/active-directory-domain-services/configure-ldaps

此外，应用服务是一个沙盒环境。