C# 使用 LDAP 连接到 Active Directory 的连接字符串
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/15157746/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Connection string to connect to Active Directory using LDAP
提问by Newton Sheikh
my system admin gave me this:
我的系统管理员给了我这个：
Domain : capp.net USER : capp\dhr2
域：capp.net 用户：capp\dhr2
Pass : admin@12345
通行证：admin@12345
what will the connection string be?
连接字符串是什么？
I am very very new to adfs. So i tried this:
我对 adfs 非常陌生。所以我试过这个：
<add name="ADConnectionString"
connectionString="LDAP://capp.net/CN=dhr,DC=capp,DC=net" />
<authentication mode="Forms">
<forms name=".ADAuthCookie" timeout="43200"/>
</authentication>
<authorization>
</authorization>
<membership>
<providers>
<clear/>
<add name="MyADMembershipProvider"
type="System.Web.Security.ActiveDirectoryMembershipProvider"
connectionUsername="cn=dhr2"
connectionPassword="admin@12345"
connectionStringName="ADConnectionString"/>
</providers>
</membership>
I am always getting this error: Unable to establish secure connection with the server
我总是收到此错误：无法与服务器建立安全连接
I am doing someting wrong with the connection string. I just dont know how to fix it.
我的连接字符串有问题。我只是不知道如何修复它。
采纳答案by SOfanatic
Whenever I've accessed AD from .net I've done the following:
每当我从 .net 访问 AD 时，我都会执行以下操作：
var directoryEntry = new DirectoryEntry("LDAP://capp.net");
directoryEntry.Username = "capp\dhr2";
directoryEntry.Password = "admin@12345";
Then you can query "AD" using the DirectorySearcher.
然后您可以使用 DirectorySearcher 查询“AD”。
var directorySearcher = new DirectorySearcher(directoryEntry);
...
...
回答by jwilleke
We have found this to work best to be sure you have the right parameters:
我们发现这最能确保您拥有正确的参数：
Often the hard part of connecting to AD using LDAP is Determining the FDN of the user to login with.If you know the samAccountName of the user you can find it using:
通常，使用 LDAP 连接到 AD 的困难部分是确定要登录的用户的 FDN。如果您知道用户的 samAccountName，您可以使用以下方法找到它：
dsquery user -samid jim
"CN=Jim Willeke,CN=Users,DC=mad,DC=willeke,DC=com"
回答by Robert Rossmann
For Active Directory, the ldap connection string can take this form:
对于 Active Directory，ldap 连接字符串可以采用以下形式：
protocol://domaindnsaddress
协议：//域dns地址
where protocol can be either ldap://or ldaps://, depending on whether to use standard or SSL connection. You should always troubleshoot using standard connection before moving to SSL/TLS to avoid certificate issues at this point.
其中协议可以是ldap://或ldaps://，具体取决于是使用标准连接还是 SSL 连接。在迁移到 SSL/TLS 之前，您应该始终使用标准连接进行故障排除，以避免此时出现证书问题。
domaindnsaddress is DNS-resolvable address of your domain - in your case capp.net .
domaindnsaddress 是您域的 DNS 可解析地址 - 在您的情况下是 capp.net 。
Some programming languages, like php, do not require the ldap:// prefix to perform a connect operation. You may try connecting without it as well.
某些编程语言，例如 php，不需要 ldap:// 前缀来执行连接操作。您也可以尝试在没有它的情况下进行连接。
The username to log in can have several forms. The most common are:
登录的用户名可以有多种形式。最常见的是：
- NetBIOS domain name\samaccountname ( CAPP\dhr2- note the BACKslash )
- userprincipanname ( [email protected])
- samaccountname@domaindnsname ( [email protected])
- NetBIOS 域名\samaccountname（CAPP\dhr2- 注意反斜杠）
- userprincipanname ( [email protected])
- samaccountname@domaindnsname ( [email protected])
You can read Microsoft's extensive information about the possible forms of your logon name here:
MSDN - Simple Authentication
Password does not need any special treatment - just perform the standard bind operation against your ldap server and you should be authenticated.
Please note that I am intentionally notincluding any sample code as your question was about the connection string, not about connecting to ldap using C# libraries.
您可以在此处阅读 Microsoft 有关登录名可能形式的大量信息：
MSDN - 简单身份验证
密码不需要任何特殊处理 - 只需对您的 ldap 服务器执行标准绑定操作，您就应该通过身份验证。
请注意，我故意不包含任何示例代码，因为您的问题是关于连接字符串，而不是关于使用 C# 库连接到 ldap。
回答by Newton Sheikh
Thanks to everyone for your help and support. The correct address in my case was:
感谢大家的帮助和支持。在我的情况下，正确的地址是：
LDAP://192.168.0.146/CN=USERS,DC=capp,DC=net
LDAP://192.168.0.146/CN=USERS,DC=capp,DC=net
What i didnt realize in the beginning was that i was trying to connect to Active Directory in a different domain than my current domain. So the Ip address was the missing part. thanks a million to Luis who realized that there was something wrong was with the domain.
一开始我没有意识到我试图连接到与当前域不同的域中的 Active Directory。所以IP地址是缺失的部分。一百万感谢 Luis，他意识到域名出了问题。
And thanks Shadow Walker for explaining the ldap connection string in more details.
并感谢 Shadow Walker 更详细地解释了 ldap 连接字符串。
