asp.net-mvc-5 – 带有LDAP身份验证的OWIN

> AccountController.cs – 创建应用程序用户并登录

    ApplicationUser usr = new ApplicationUser() { UserName = model.Email };
    bool auth = await UserManager.CheckPasswordAsync(usr,model.Password);
    if (auth)
                {
                    List claims = new List();


> IdentityConfig.cs(CheckPasswordAsync) - 针对LDAP进行身份验证

public override async Task CheckPasswordAsync(ApplicationUser user,string password)
        {
            PrincipalContext dc = new PrincipalContext(ContextType.Domain,"domain",[user_name],[password]);
            bool authenticated = dc.ValidateCredentials(user.UserName,password);
            return authenticated;
        }

> Global.asax  - 如果您在登录表单中使用Anti Forgery Token
AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;
此时,您将登录并可以访问User.Identity对象.您还可以使用[授权(Roles =“some_role”)标记控制器和操作
事实证明,这比我想象的要容易,只是在这个主题上写的并不多(至少我找不到任何东西).
此外,此代码假定您从可以访问网络上的域控制器的服务器运行应用程序.如果您使用的是DMZ服务器,则需要与网络管理员讨论此策略以获取其他选项.
我希望这能节省你一些时间.我也渴望听到社区对此的看法.也许有更好的方法来处理这种情况.如果是这样,请在此处分享.
谢谢.
Daniel D.
foreach (var group in Request.LogonUserIdentity.Groups)
            {
                string role = new SecurityIdentifier(group.Value).Translate(typeof(NTAccount)).Value;
                string clean = role.Substring(role.IndexOf("") + 1,role.Length - (role.IndexOf("") + 1));
                claims.Add(new Claim(ClaimTypes.Role,clean));
            }
            claims.Add(new Claim(ClaimTypes.NameIdentifier,model.Email));
            claims.Add(new Claim(ClaimTypes.Name,model.Email));
            ClaimsIdentity ci = new ClaimsIdentity(claims,DefaultAuthenticationTypes.ApplicationCookie);
             AuthenticationManager.SignIn(new AuthenticationProperties()
             {
                 AllowRefresh = true,IsPersistent = false,ExpiresUtc = DateTime.UtcNow.AddDays(7),},ci);
             return RedirectToLocal(returnUrl);
            }
            else
            {
                ModelState.AddModelError("","Invalid login credentials.");
                return View(model);
            }