問題描述

我有一個 asp.net 應用程序，它需要使用表單身份驗證將用戶登錄到 Active Directory(Windows 身份驗證不是具有給定要求的選項).

I have an asp.net app which needs to log users into Active Directory using forms authentication (windows authentication isn't an option with the given requirements).

我像這樣保存身份驗證 cookie:

I'm saving authentication cookies like so:

if (Membership.ValidateUser(model.UserName, model.Password))
{
    FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
}

這很有效，除了即使用戶更改了 Active Directory 密碼后，cookie 也會對用戶進行身份驗證.

This works great, except that the cookie authenticates the user even after they change their Active Directory password.

有沒有辦法判斷用戶的密碼是否已更改?

Is there a way to tell if the user's password has changed?

我在 .NET 4 中使用 asp.net MVC3

I'm using asp.net MVC3 with .NET 4

我的嘗試

如果覺得這段代碼應該可以工作，但是 HttpWebResponse 永遠不會包含任何 cookie.不太確定我做錯了什么.

If feel like this code should work, however the HttpWebResponse never contains any cookies. Not quite sure what I'm doing wrong.

HttpWebRequest request = (HttpWebRequest)WebRequest.Create(Request.Url);
request.CookieContainer = new CookieContainer();

HttpWebResponse response = (HttpWebResponse)request.GetResponse();

Cookie authCookie = response.Cookies["AuthCookie"];
if (authCookie.TimeStamp.CompareTo(Membership.GetUser().LastPasswordChangedDate) < 0)
{
    authCookie.Expired = true;
}

推薦答案

你的代碼應該閱讀

if (Membership.ValidateUser(model.UserName, model.Password))
{
  string userData = DateTime.Now.ToString();

  FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
    username,
    DateTime.Now,
    DateTime.Now.AddMinutes(30),
    isPersistent,
    userData,
    FormsAuthentication.FormsCookiePath);

  // Encrypt the ticket.
  string encTicket = FormsAuthentication.Encrypt(ticket);

  // Create the cookie.
  Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
}

現在，當驗證用戶時

HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(authCookie.value);
if (DateTime.Parse(ticket.UserData) > Membership.GetUser().LastPasswordChangedDate)
{
    FormsAuthentication.SignOut();
    FormsAuthentication.RedirectToLoginPage();
}

這篇關于檢查 Active Directory 密碼是否與 cookie 不同的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！