Sharepoint 2010 Form 身份认证的实现（基于AD）

xitongyunwei

浏览: 921963 次

最近访客更多访客>>

么么语

u012363178

wangyy

songhait

博主相关

博客

微博

相册

留言

关于我

文章分类

全部博客 (1854)

社区版块

存档分类

2013-10 ( 10)
2013-09 ( 63)
2013-08 ( 130)
更多存档...

写之前，我发下感慨，我为了弄这个from认证花费了4天时间，而且每天都熬夜2点才睡觉，最后还是在和 foley 讨论下才真正成功实现了，这里form认证和2007不一样，它的用户是存在AD里面的，所以需要域服务器，外国的文章和MSND上也只提供了这种方式，现在我也没法实现2007那种SQL数据库保存用户的方法，因为在登录的时候会爆一个很BT得错误(经过多方努力，终于找到文档实现SQL保存用户了)，好了我现在介绍怎么配置form认证：

一。进管理中心，创建一个应用程序，配置如下：

二。填端口号，和选择form身份认证，以及填写成员和角色，其他都默认就可以了

三。使用SharePoint 2010 Management Shell在里面填写下面的代码

代码


<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->$webApp = Get-SPWebApplication "http://cd-isbunet:82" 
$webApp.UseClaimsAuthentication = 1; 
$webApp.Update() 
$webApp.ProvisionGlobally()
$webApp = Get-SPWebApplication "http://cd-isbunet:82" 
$webApp.MigrateUsers($True)

http://cd-isbunet:82 是我刚才创建的应用程序，你需要改成你自己的

四。最重要的一步，修改管理中心，我们创建的应用程序，还有Web服务里面的SecurityTokenServiceApplication（2007是不需要配置这个的）这个3个地方的web.config

1.找到管理中心的<system.web></system.web>,配置如下：

这里先解释下里面的代码，你只需要替换

server="cd-isbunet.ncs.corp.int-ads" //域控的地址
userContainer="CN=Users,DC=ncs,DC=corp,DC=int-ads" //Users不用换 DC为你域的信息

groupContainer="DC=ncs,DC=corp,DC=int-ads"

connectionUsername="XXX/jiangly" //换成自己的域管理员
connectionPassword="123456" />

代码


<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->  <membership defaultProvider="AspNetSqlMembershipProvider">

<providers>

<!-- ADMembership-->

<add name="ADMembership"

                                           type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                           server="cd-isbunet.ncs.corp.int-ads"

                                           port="389"

                                           useSSL="false"

                                           userDNAttribute="distinguishedName"

                                           userNameAttribute="sAMAccountName"

                                           userContainer="CN=Users,DC=ncs,DC=corp,DC=int-ads"

                                           userObjectClass="person"

                                           userFilter="(&amp;(ObjectClass=person))"

                                           scope="Subtree"

                                           otherRequiredUserAttributes="sn,givenname,cn"

                                           connectionUsername="XXX/jiangly"

                                           connectionPassword="123456" />

<!-- ADMembership-->

</providers>

</membership >

<roleManager defaultProvider="AspNetWindowsTokenRoleProvider"  enabled ="true">

<providers>

<add name="roleManager"

                                           type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                           server="cd-isbunet.ncs.corp.int-ads"

                                           port="389"

                                           useSSL="false"

                                           groupContainer="DC=ncs,DC=corp,DC=int-ads"

                                           groupNameAttribute="cn"

                                           groupNameAlternateSearchAttribute="samAccountName"

                                           groupMemberAttribute="member"

                                           userNameAttribute="sAMAccountName"

                                           dnAttribute="distinguishedName"

                                           groupFilter="(&amp;(ObjectClass=group))"

                                           userFilter="(&amp;(ObjectClass=person))"

                                           scope="Subtree"

                                           connectionUsername="XXX/jiangly"

                                           connectionPassword="123456" />



</providers>

</roleManager>

2.找到应用程序的<system.web></system.web>,配置如下：

代码


<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--> <machineKey validationKey="D35D48269B8B92E8A7D86FB64FBFCC4B2B4F1E3A0BFC43FB" decryptionKey="FEA7B512E6E390C18283E0D2E0542564F1E47E1F0A80F335" validation="SHA1" />
<membership defaultProvider="i">

<providers>

<add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<!-- ADMembership-->

<add name="ADMembership" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                   server="cd-isbunet.ncs.corp.int-ads"

                                   port="389" useSSL="false"

                                   userDNAttribute="distinguishedName"

                                   userNameAttribute="sAMAccountName"

                                   userContainer="CN=Users,DC=ncs,DC=corp,DC=int-ads"

                                   userObjectClass="person"

                                   userFilter="(&amp;(ObjectClass=person))"

                                   scope="Subtree"

                                   otherRequiredUserAttributes="sn,givenname,cn"

                             connectionUsername="XXX/jiangly"

                                       connectionPassword="123456" />

<!-- ADMembership-->

</providers>

</membership>

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">

<providers>

<add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<!-- ADMembership-->

<add name="roleManager" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                   server="cd-isbunet.ncs.corp.int-ads"

                                   port="389"

                                   useSSL="false"

                                   groupContainer="DC=ncs,DC=corp,DC=int-ads"

                                   groupNameAttribute="cn"

                                   groupNameAlternateSearchAttribute="samAccountName"

                                   groupMemberAttribute="member"

                                   userNameAttribute="sAMAccountName"

                                   dnAttribute="distinguishedName"

                                   groupFilter="(&amp;(ObjectClass=group))"

                                   userFilter="(&amp;(ObjectClass=person))"

                                   scope="Subtree"

                               connectionUsername="XXX/jiangly"

                                       connectionPassword="123456" />

<!-- ADMembership-->

</providers>

</roleManager>

3.找到SecurityTokenServiceApplication站台web.config,它里面没有<system.web></system.web>,你需要自己添加

代码


<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--> <system.web>
<!-- ADMembership-->

<membership>

<providers>

<!-- ADMembership-->

<add name="ADMembership"

                                             type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                             server="cd-isbunet.ncs.corp.int-ads"

                                             port="389"

                                             useSSL="false"

                                             userDNAttribute="distinguishedName"

                                             userNameAttribute="sAMAccountName"

                                             userContainer="CN=Users,DC=ncs,DC=corp,DC=int-ads"

                                             userObjectClass="person"

                                             userFilter="(&amp;(ObjectClass=person))"

                                             scope="Subtree"

                                             otherRequiredUserAttributes="sn,givenname,cn"

                                             connectionUsername="XXX/jiangly"

                                       connectionPassword="123456" />

<!-- ADMembership-->

</providers>

</membership>

<roleManager enabled ="true" >

<providers>

<!-- ADMembership-->

<add name="roleManager"

                                             type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

                                             server="cd-isbunet.ncs.corp.int-ads"

                                             port="389"

                                             useSSL="false"

                                             groupContainer="DC=ncs,DC=corp,DC=int-ads"

                                             groupNameAttribute="cn"

                                             groupNameAlternateSearchAttribute="samAccountName"

                                             groupMemberAttribute="member"

                                             userNameAttribute="sAMAccountName"

                                              dnAttribute="distinguishedName"

                                             groupFilter="(&amp;(ObjectClass=group))"

                                             userFilter="(&amp;(ObjectClass=person))"

                                             scope="Subtree"

                                             connectionUsername="XXX/jiangly"

                                       connectionPassword="123456" />

<!-- ADMembership-->

</providers>

</roleManager>

</system.web>