【发布时间】：2016-03-22 12:42:11
【问题描述】：
我有一个使用 Windows 身份验证和 Exchange Web 服务的 MVC Web 应用程序。在开发过程中，这很好用，因为我的开发机器上的 IIS 中的应用程序池设置为在我的 windows 用户下运行，而 Exchange Server 位于同一个域中。
但是，在 Web 服务器上，我们所有的应用程序都设置为在有权访问所有数据库服务器等的系统用户下运行。数据库连接使用集成安全性，因此我无法在应用程序级别上模拟用户。
我一直在尝试通过如下代码来冒充当前windows用户：
public abstract class ExchangeServiceImpersonator
{
private static WindowsImpersonationContext _ctx;
public Task<string> CreateMeetingAsync(string from, List<string> to, string subject, string body, string location, DateTime begin, DateTime end)
{
var tcs = new TaskCompletionSource<string>();
EnableImpersonation();
try
{
tcs.TrySetResult(CreateMeetingImpersonated(from, to, subject, body, location, begin, end));
}
catch(Exception e)
{
tcs.TrySetException(e);
}
finally
{
DisableImpersonation();
}
return tcs.Task;
}
public abstract string CreateMeetingImpersonated(string from, List<string> to, string subject, string body, string location, DateTime begin, DateTime end);
private static void EnableImpersonation()
{
WindowsIdentity winId = (WindowsIdentity)HttpContext.Current.User.Identity;
_ctx = winId.Impersonate();
}
private static void DisableImpersonation()
{
if (_ctx != null)
_ctx.Undo();
}
}
那么，实现抽象方法的类：
public class ExchangeServiceExtensionsBase : ExchangeServiceImpersonator
{
private ExchangeService _service;
public ExchangeService Service
{
get
{
if (this._service == null)
{
this._service = new ExchangeService(ExchangeVersion.Exchange2013);
this._service.Url = new Uri(WebConfigurationManager.AppSettings["ExchangeServer"]);
this._service.UseDefaultCredentials = true;
}
return this._service;
}
set { return; }
}
public override string CreateMeetingImpersonated(string from, List<string> to, string subject, string body, string location, DateTime begin, DateTime end)
{
//this.Service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, from);
Appointment meeting = new Appointment(Service);
string meetingID = Guid.NewGuid().ToString();
meeting.Subject = subject;
meeting.Body = "<span style=\"font-family:'Century Gothic'\" >" + body.Replace(Environment.NewLine, "<br/>") + "<br/><br/>" +
"<span style=\"color: white;\">Meeting Identifier: " + meetingID + "</span></span><br/><br/>";
meeting.Body.BodyType = BodyType.HTML;
meeting.Start = begin;
meeting.End = end;
meeting.Location = location;
meeting.ReminderMinutesBeforeStart = 60;
foreach (string attendee in to)
{
meeting.RequiredAttendees.Add(attendee);
}
meeting.Save(SendInvitationsMode.SendToAllAndSaveCopy);
return meetingID;
}
}
然后，访问方法如下：
public static class ExchangeServiceExtensions
{
public static async Task<string> CreateMeetingAsync(string from, List<string> to, string subject, string body, string location, DateTime begin, DateTime end)
{
ExchangeServiceImpersonator serviceImpersonator = new ExchangeServiceExtensionsBase();
return await serviceImpersonator.CreateMeetingAsync(from, to, subject, body, location, begin, end);
}
}
这在我的本地开发机器上仍然有效，但无论我做什么，从服务器访问的用户都会不断收到来自交换服务器的访问被拒绝：
请求失败。远程服务器返回错误：(401) Unauthorized.
我已尝试将其保留为默认凭据：
this._service.UseDefaultCredentials = true;
并尝试手动将凭据设置为当前（假设是模拟的）用户：
this._service.Credentials = new WebCredentials(CredentialCache.DefaultNetworkCredentials);
另外，我尝试通过电子邮件地址使用 Exchange ImpersonatedUserId 对象：
this._service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, from);
返回以下异常：
该帐户无权模拟请求的用户。
【问题讨论】：
标签： asp.net exchangewebservices credentials ews-managed-api