Windows 身份验证与表单身份验证

windows authentication vs forms authentication

提问by dotnetrocks

I am trying to understand concepts of windows authentication, forms authentication and their differences. I am confused. Can someone help me in clarifying this.

我试图了解 Windows 身份验证、表单身份验证及其差异的概念。我很迷惑。有人可以帮我澄清这一点。

Thanks.

谢谢。

回答by Sajith A.K.

Windows Authenticationprovider is the default authentication provider for ASP.NET applications. When a user using this authentication logs in to an application, the credentials are matched with the Windows domain through IIS.

Windows 身份验证提供程序是 ASP.NET 应用程序的默认身份验证提供程序。当使用此身份验证的用户登录应用程序时，凭据将通过 IIS 与 Windows 域进行匹配。

There are 4 types of Windows Authentication methods:

有 4 种类型的 Windows 身份验证方法：

1) Anonymous Authentication - IIS allows any user

1) 匿名身份验证 - IIS 允许任何用户

2) Basic Authentication - A windows username and password has to be sent across the network (in plain text format, hence not very secure).

2) 基本身份验证 - 必须通过网络发送 Windows 用户名和密码（以纯文本格式，因此不是很安全）。

3) Digest Authentication - Same as Basic Authentication, but the credentials are encrypted. Works only on IE 5 or above

3) 摘要式身份验证 - 与基本身份验证相同，但凭据是加密的。仅适用于 IE 5 或更高版本

4) Integrated Windows Authentication - Relies on Kerberos technology, with strong credential encryption

4) 集成 Windows 身份验证 - 依赖 Kerberos 技术，具有强大的凭据加密

Forms Authentication- This authentication relies on code written by a developer, where credentials are matched against a database. Credentials are entered on web forms, and are matched with the database table that contains the user information.

表单身份验证- 此身份验证依赖于开发人员编写的代码，其中凭据与数据库进行匹配。凭据在 Web 表单上输入，并与包含用户信息的数据库表匹配。

回答by Hades

Windows Authenticationrefers to authenticating against Windows user accounts on the box that the application is running on.

Windows 身份验证是指对运行应用程序的机器上的 Windows 用户帐户进行身份验证。

Forms authenticationis a stand alone method of authenticating in .NET forms that you can hook up to some other system, such as a database.

表单身份验证是一种在 .NET 表单中进行身份验证的独立方法，您可以将其连接到某些其他系统，例如数据库。

回答by eandersson

It's pretty simple. Windows Authenticationmakes use of the Windows Login system. http://en.wikipedia.org/wiki/Integrated_Windows_Authentication

这很简单。Windows Authentication使用Windows Login system. http://en.wikipedia.org/wiki/Integrated_Windows_Authentication

And with Forms Authenticationthe user will need to provide a usernameand passwordmanually. http://www.asp.net/web-forms/tutorials/security/introduction/an-overview-of-forms-authentication-vb

并与Forms Authentication用户将需要提供一个username和password手动。 http://www.asp.net/web-forms/tutorials/security/introduction/an-overview-of-forms-authentication-vb

The Forms Authenticationalso allows you to choose where you access the login data from. It could for example be stored in your own local database. While Windows Authentication is only going to use your Windows login data. This data usually comes from Active Directory, if your network is built using an enterprise/buisness/domainsetup. http://en.wikipedia.org/wiki/Active_Directory

该Forms Authentication还允许您选择您从访问登录数据。例如，它可以存储在您自己的local database. 而 Windows 身份验证只会使用您的 Windows 登录数据。Active Directory如果您的网络是使用enterprise/buisness/domain设置构建的，则此数据通常来自。 http://en.wikipedia.org/wiki/Active_Directory

回答by Arvind Umamaheswar

Windows Authentication-- The user will be authenticated on the IIS server against the credentials he provided when logging into his system. If the authentication fails then a pop up form will be displayed in the Internet Explorer asking for his credentials i.e. username and password.

Windows 身份验证——用户将在 IIS 服务器上根据他登录系统时提供的凭据进行身份验证。如果身份验证失败，则 Internet Explorer 中将显示一个弹出表单，询问他的凭据，即用户名和密码。

Forms Authentication-- A default Login Page will be available like Facebook login, where user will be authenticated instead of automatically getting the credentials from the system credentials i.e. the current user of the Windows system. If the user requests a secure page and has not logged in, then ASP.NET redirects him/her to the login page. Once the user is authenticated, he/she will be allowed to access the requested page. Here IIS does not come into effect for authentication, it completely depends on the web application.

表单身份验证——默认登录页面将可用，如 Facebook 登录，用户将在其中进行身份验证，而不是自动从系统凭据（即 Windows 系统的当前用户）获取凭据。如果用户请求安全页面但尚未登录，则 ASP.NET 会将他/她重定向到登录页面。一旦用户通过身份验证，他/她将被允许访问请求的页面。这里IIS不生效认证，完全依赖web应用。