VOL框架使用LDAP身份验证登录

背景

最近一直在VOL框架里面写管理系统，由于公司对于安全性的要求比较高，框架默认使用用户名+密码+验证码的方式，但是系统最大的威胁往往来源于内部用户，为了防止密码泄露，在框架里面自己写了个LDAP的Helper，同时为了方便部署，LDAP的所有参数都放在appsetting.json文件里。

LDAP

.net 里有多个LDAP的包，我使用了微软自己的DirectoryService，VS自带。代码找的网上的，稍微做了一些修改。代码如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using VOL.Core.Configuration;
using VOL.Core.Extensions;
using System.DirectoryServices;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Hosting;
using OfficeOpenXml.FormulaParsing.Excel.Functions.RefAndLookup;
using System.Xml.Linq;

namespace VOL.Core.Utilities.LDAP
{
    public class LDAPHelper
    {
        private DirectoryEntry _objDirectoryEntry;        
        private static string ldapUrl { get; set; }
        private static string ldapUserName { get; set; }
        private static string ldapPassword { get; set; }
        static LDAPHelper()
        {
            IConfigurationSection section = AppSetting.GetSection("LDAP");
            ldapUrl =section["ldapUrl"];
            ldapUserName = section["ldapUserName"];
            ldapPassword = section["ldapPassword"];  
        }
        public bool OpenConnection()
        {    //创建一个连接 
            _objDirectoryEntry = new DirectoryEntry(ldapUrl, ldapUserName, ldapPassword, AuthenticationTypes.ReadonlyServer);
            if (null == _objDirectoryEntry)
            {
                return false;
            }
            else if (_objDirectoryEntry.Properties != null && _objDirectoryEntry.Properties.Count > 0)
            {
                return true;
            }
            return false;
        }

        /// <summary>
                /// 检测一个用户和密码是否正确
                /// </summary>
                /// <param name="strLDAPFilter">(|(uid= {0})(cn={0}))</param>
                /// <param name="TestUserID">testuserid</param>
                /// <param name="TestUserPwd">testuserpassword</param>
                /// <param name="ErrorMessage"></param>
                /// <returns></returns>
        public bool CheckUidAndPwd(string TestUserID, string TestUserPwd, ref string ErrorMessage)
        {
            bool blRet = false;
            try
            {
                //创建一个检索
                DirectorySearcher deSearch = new DirectorySearcher(_objDirectoryEntry);
                //过滤名称是否存在
                deSearch.Filter = "sAMAccountName=" + TestUserID + "";
                deSearch.SearchScope = SearchScope.Subtree;
                //find the first instance 
                SearchResult objSearResult = deSearch.FindOne();
                //如果用户密码为空
                if (string.IsNullOrEmpty(TestUserPwd))
                {
                    if (null != objSearResult && null != objSearResult.Properties && objSearResult.Properties.Count > 0)
                    {
                        blRet = true;
                    }
                }
                else if (null != objSearResult && !string.IsNullOrEmpty(objSearResult.Path))
                {
                    //获取用户名路径对应的用户uid
                    int pos = objSearResult.Path.LastIndexOf('/');
                    string uid = objSearResult.Path.Remove(0, pos + 1);
                    DirectoryEntry objUserEntry = new DirectoryEntry(objSearResult.Path, uid, TestUserPwd, AuthenticationTypes.None);
                    if (null != objUserEntry && objUserEntry.Properties.Count > 0)
                    {
                        blRet = true;
                    }
                }
            }
            catch (Exception ex)
            {
                if (null != _objDirectoryEntry)
                {
                    _objDirectoryEntry.Close();
                }
                ErrorMessage = "检测异常：" + ex.StackTrace;
            }
            return blRet;
        }
        /// <summary>
        /// 关闭连接
        /// </summary>
        public void closeConnection()
        {
            if (null != _objDirectoryEntry)
            {
                _objDirectoryEntry.Close();
            }
        }
    }
}

appsetting.json添加LDAP配置

将LDAPHelper读取的参数都放到appsetting.json文件中

VOL框架使用

1、在VOL.Core.Utilities里新建一个目录，创建LDAPHelper.cs,将上面的代码复制过去。然后找到VOL.System.Services下的System/Partial下的System_UserService.cs，添加读取设置

        string loginType = AppSetting.GetSettingString("loginType");

2、找到try块，改写登录，添加LDAP验证

try
            {
                Sys_User user = await repository.FindAsIQueryable(x => x.UserName == loginInfo.UserName)
                    .FirstOrDefaultAsync();
                if (loginType == "1")
                {
                    // 原始登录
                    if (user == null || loginInfo.Password.Trim().EncryptDES(AppSetting.Secret.User) != (user.UserPwd ?? ""))
                        return webResponse.Error(ResponseType.LoginError);                   
                }
                else
                {
                    //LDAP登录
                    LDAPHelper objldap = new LDAPHelper();
                    bool blRet = objldap.OpenConnection();
                    if (user == null || !objldap.CheckUidAndPwd(loginInfo.UserName, loginInfo.Password, ref msg))
                    {
                        return webResponse.Error(ResponseType.LoginError);
                    }
                }
                string token = JwtHelper.IssueJwt(new UserInfo()
                {
                    User_Id = user.User_Id,
                    UserName = user.UserName,
                    Role_Id = user.Role_Id
                });
                user.Token = token;
                webResponse.Data = new { token, userName = user.UserTrueName, img = user.HeadImageUrl };
                repository.Update(user, x => x.Token, true);
                UserContext.Current.LogOut(user.User_Id);

                loginInfo.Password = string.Empty;

                return webResponse.OK(ResponseType.LoginSuccess);
            }
            catch (Exception ex)
            {
                msg = ex.Message + ex.StackTrace;
                if (_context.GetService<Microsoft.AspNetCore.Hosting.IWebHostEnvironment>().IsDevelopment())
                {
                    throw new Exception(ex.Message + ex.StackTrace);
                }
                return webResponse.Error(ResponseType.ServerError);
            }
            finally
            {
                memoryCache.Remove(loginInfo.UUID);
                Logger.Info(LoggerType.Login, loginInfo.Serialize(), webResponse.Message, msg);
            }

踩坑

之前部署为http网站都没有问题，后来升级成https时候LDAP一直报异常，搞得很郁闷，上优快云提问也没有找到答案，不过给了个思路是验证LDAPS，而不是LDAP。结果把地址改为LDAPS一直不行，又找了半天，才发现验证LDAPS不需要把地址改成LDAPS，还是用LDAP，只需把端口改一下。