Question

这是一个复杂的问题，请耐心等待。

场景：使用ASHX代理将请求中继到ArcGIS服务器。尝试使用ASP.NET模拟，以便在向ArcGIS服务器发送请求时，代理使用登录的ASP.NET用户凭据。

问题：尽管我知道模拟帐户（sean.ryan-B + sean.ryan）确实有访问权限，但拒绝了对ArcGIS服务器的代理请求401。

有4台机器：

1. machine hosting proxy page.  I am logged in as: sean.ryan-B
2. a test machine. I am logged in as sean.ryan-B
3. my laptop. I am logged in as sean.ryan
4. the arcgis server.

All 4 machines are on the same domain.

web.config:
  <authentication mode="Windows"/>
   <identity impersonate="true" />  <!-- userName="EUROPE\sean.ryan-B" password="xxx" -->
  <authorization>
    <deny users="?"/>
  </authorization>

Test-1. Opening a test page, in same web app as proxy, via the proxy:
http://myHost.com/sean/ProxyAsp.Net/ArcGisProxy.ashx?http://myHost.com/sean/ProxyAsp.Net
[ok on all boxes 1-3]

This looks OK - the impersonation seems look OK, 
since with impersonation OFF:    WindowsIdentity.GetCurrent().Name = the AppPool account
    with impersonation ON:    WindowsIdentity.GetCurrent().Name = EUROPE\sean.ryan or EUROPE\sean.ryan-B

Test-2. opening an image that is hosted on the same IIS (but a different site), via the proxy:
http://myHost.com/sean/ProxyAsp.Net/ArcGisProxy.ashx?http://myHost.com:10400/sites/CaSPER/SiteAssets/CaSPER.jpg
[ok on boxes 1-3]

Test-3. opening the ArcGIS map URL, via the proxy:
http://myHost.com/sean/ProxyAsp.Net/ArcGisProxy.ashx?http://mapserver1.com/ArcGIS/rest/services/Global/2D_BaseMap_SurfaceGeology/MapServer?f=json&callback=dojo.io.script.jsonp_dojoIoScript1._jsonpCallback
[fails on boxes 2,3 but succeeds on the proxy host (box 1)!]

code for the ASHX code-behind:

    public partial class ArcGisProxy : IHttpHandler, IReadOnlySessionState //ASHX     implements IReadOnlySessionState in order to be able to read from session
    {
        public void ProcessRequest(HttpContext context)
        {
            try
            {
                HttpResponse response = context.Response;

                // Get the URL requested by the client (take the entire querystring at once
                //  to handle the case of the URL itself containing querystring parameters)
                string uri = context.Request.Url.Query;
                uri = uri.Substring(1); //the Substring(1) is to skip the ?, in order to get the request URL.

                System.Net.HttpWebRequest req = (System.Net.HttpWebRequest)WebRequest.Create(uri);

                {
                    req.Credentials = CredentialCache.DefaultCredentials; //this works on local box, with -B account.  this is the account the web browser is running under (rather than the account logged into CaSPER with, as ASHX has separate server session).

                    req.ImpersonationLevel = TokenImpersonationLevel.Impersonation;
                }

                //to turn off caching: req.CachePolicy = new RequestCachePolicy(RequestCacheLevel.NoCacheNoStore);
                req.Method = context.Request.HttpMethod;
                req.ServicePoint.Expect100Continue = false;
                req.Referer = context.Request.Headers["referer"];

                // Set body of request for POST requests
                req.Method = "GET";

                // Send the request to the server
                System.Net.WebResponse serverResponse = null;
                try
                {
                    serverResponse = req.GetResponse();
                }
                catch (System.Net.WebException webExc)
                {
                    //logger.Log(GetMyUrl(), webExc, context.Request);

                    response.StatusCode = 500;
                    response.StatusDescription = webExc.Status.ToString();
                    response.Write(webExc.ToString());
                    response.Write(webExc.Response);
                    response.Write("Username = " + context.User.Identity.Name + " " + context.User.Identity.IsAuthenticated + " " + context.User.Identity.AuthenticationType);
                    response.End();
                    return;
                }

                // Set up the response to the client
                ....
                    ......

                response.End();
            }
            catch (Exception ex)
            {
                throw;
            }
        }

        public bool IsReusable
        {
            get
            {
                return false;
            }
        }
    }

注意：以下更改意味着对地图服务器的代理请求成功：

a）在web.config中设置标识，以明确地将用户名，密码设置为sean.ryan-B帐户：

-OR -

b）将App Pool帐户设置为sean.ryan-B，并在web.config文件中关闭模拟。

然而，这些变化对于生产来说是不可接受的。

问题似乎是： - ASP.NET模拟适用于托管在同一IIS上的测试页面+图像（测试1和2）但对地图服务器来说还不够。

据我所知，ArcGIS地图服务器正在使用Negotiate，然后使用Kerberos身份验证。

使用WireShark，我监控了一个成功的代理请求，并发现：在401之后，代理使用SPNEGO（Kerberos）

向AET发送GET

是否有人遇到与ArcGIS代理类似的问题？

我的理论是，第1个框架上的模拟效果更好，因为浏览器与代理在同一个框上运行。

是否限制ArcGIS Server（或其正在使用的IIS站点）以防止接受模拟？

欢迎任何建议...... 附：很难得到这篇文章 - 不得不将其中的大部分格式化为代码，因为s-o将其检测为源代码！

ASHX使用Impersonation On发送HttpWebRequest，它适用于同一服务器上的URL，但不适用于Remote ArcGIS服务器上的URL

0 个答案: