针对多个提供者的表单身份验证（SQl和AD）-Formsauthenticationagainstmultipleproviders(SQlandAD)

We have a similar situation. Our Internal users go against AD the external guys against an ADAM store. Different than your database approach, but similar in that they have two user stores. Our authentication against AD occurs in the secure zone, the web servers in the DMZ make a webservice call into the secure zone for authentication. Don't know what you are rally looking for, but your approach sounds ok.

我们有类似的情况。我们的内部用户反对AD外部人员对抗ADAM商店。与您的数据库方法不同,但类似的是它们有两个用户存储。我们针对AD的身份验证发生在安全区域中,DMZ中的Web服务器会将Web服务调用进入安全区域进行身份验证。不知道你在寻找什么,但你的方法听起来不错。

EDIT to answer comments:

编辑回答评论:

• The ADAM store is not synced with the database.

ADAM存储未与数据库同步。

• Basically there were two providers that the webservice was configured to use, one for each store. I fact, there were three for a period of time when users were migrated from the legacy system. To determine which store a user was in, the application simply asked the most common provider first (ADAM in our case) and if the user did not exist, it would move to the next provider.

基本上,有两个Web服务配置使用的提供程序,每个存储一个。事实上,有一段时间用户从遗留系统迁移。为了确定用户所在的商店,应用程序首先只询问最常见的提供商(在我们的例子中是ADAM),如果用户不存在,它将转移到下一个提供商。

• The endpoint was the webservice, inside the firewall, running on a the middle tier server. That server did run IIS, so technically it was a webserver, but actually our middle tier server as it did not serve up any pages or host anything other than a few webservices.

端点是防火墙内部在中间层服务器上运行的Web服务。该服务器确实运行了IIS,因此从技术上讲它是一个Web服务器,但实际上是我们的中间层服务器,因为它不提供任何页面或托管除了一些Web服务之外的任何东西。

• So it sounds like you have 2 types of external users. Ones that are really internal users (in AD) and ones that are truely external (in DB). This is not very elegant, but you could ave 2 login screens, one for each. Don't publish the internal users external login screen to anyone but them, and publish the real external login screen to teh world. A little hacky but it would work. Otherwise, you login would process will need to identify the type of user.

所以听起来你有两种类型的外部用户。实际上是内部用户(在AD中)和真正在外部(在DB中)的用户。这不是很优雅,但您可以使用2个登录屏幕,每个屏幕一个。不要将内部用户外部登录屏幕发布给除他们之外的任何人,并将真实的外部登录屏幕发布到世界。有点hacky但它​​会工作。否则,您登录的过程将需要识别用户的类型。