DirectoryEntry安全氪星

Question

嗨，我有一个我运行的exe，它运行在我登录的域帐户的上下文中。代码只是在特定OU下查询活动目录中的用户。我从一台连接到林的机器上运行以下代码：CompanyNameDomain.NET.

现在安全小组要求我确保这个脚本和域控制器之间的所有通信都是安全的、加密的等等。请注意，我不会在DirectoryEntry()构造函数中传递用户名DirectoryEntry数据。我看过StackOverflow，大多数问题都是关于如何通过在DirectoryEntry构造函数中传递用户名/密码来加密身份验证的。但是我的问题是如何确保这个脚本和域控制器之间的所有通信都是加密的？代码工作正常，没有任何问题。我只是不知道我是否需要做点别的什么？我在LDAP名称对象值中使用:636。

    using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.DirectoryServices;

namespace ConsoleApplication1
{

    public class CompanyNameExtranetUser
    {
        public byte[] objectGUID { get; set; }
        public string sAMAccountName { get; set; }
        public string givenName { get; set; }
        public string sn { get; set; }
        public string displayName { get; set; }
        public string telephoneNumber { get; set; }
        public string extensionAttribute1 { get; set; }
        public string extensionAttribute5 { get; set; }
        public string extensionAttribute8 { get; set; }
        public int userAccountControl { get; set; }
        public bool isEnabled { get; set; }

        private string _mail;
        public string mail { get { return _mail; } set { _mail = value.ToLower(); } }

        public string inviteId { get; set; }
        public string AzureObjectId { get; set; }

    }
    class Program
    {
        static void Main(string[] args)
        {
            const int UF_ACCOUNTDISABLE = 0x0002;
            string ldapPath = "LDAP://CompanyNameDomain.NET:636/OU=CompanyNameClientsSCIMProv,DC=CompanyNameDomain,DC=NET";

            DirectoryEntry _de = new DirectoryEntry(ldapPath);

            string ldapFilter = "(&(objectClass=user)(extensionAttribute8=2))";
            List<CompanyNameExtranetUser> _CompanyNameExtranetUsers;
            SearchResultCollection src;
            string[] _attributeList =   {
                                            "objectGUID",
                                            "sAMAccountName",
                                            "mail",
                                            "givenName",
                                            "sn",
                                            "displayName",
                                            "telephoneNumber",
                                            "userAccountControl",
                                            "extensionAttribute1",
                                            "extensionAttribute5",
                                            "extensionAttribute8"
                                        };



            try
            {
                using (DirectorySearcher _ds = new DirectorySearcher(_de))
                {
                    _ds.SearchScope = SearchScope.Subtree;
                    _ds.Filter = ldapFilter;
                    _ds.PropertiesToLoad.AddRange(_attributeList);
                    _ds.Asynchronous = true;

                    src = _ds.FindAll();

                    if (src.Count > 0)
                    {
                        _CompanyNameExtranetUsers = new List<CompanyNameExtranetUser>();

                        foreach (SearchResult sr in src)
                        {
                            CompanyNameExtranetUser user = new CompanyNameExtranetUser();

                            foreach (string _attributeName in _ds.PropertiesToLoad)
                            {

                                try
                                {
                                    switch (_attributeName)
                                    {

                                        case "sAMAccountName":
                                            user.sAMAccountName = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "mail":
                                            user.mail = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "extensionAttribute1":
                                            user.extensionAttribute1 = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "extensionAttribute5":
                                            user.extensionAttribute5 = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "extensionAttribute8":
                                            user.extensionAttribute8 = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "telephoneNumber":
                                            user.telephoneNumber = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "givenName":
                                            user.givenName = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "sn":
                                            user.sn = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "displayName":
                                            user.displayName = sr.Properties[_attributeName][0].ToString();
                                            break;

                                        case "objectGUID":
                                            user.objectGUID = (byte[])sr.Properties[_attributeName][0];
                                            break;

                                        case "userAccountControl":
                                            user.userAccountControl = (Int32)sr.Properties[_attributeName][0];
                                            user.isEnabled = Convert.ToBoolean(user.userAccountControl & UF_ACCOUNTDISABLE) ? false : true;
                                            break;

                                        default:
                                            break;

                                    }
                                }
                                catch (ArgumentOutOfRangeException Ex)
                                {
                                    // do nothing.                                                                 
                                }
                            }

                            _CompanyNameExtranetUsers.Add(user);
                            Console.WriteLine(string.Format("{0}", user.mail));
                        }
                    }
                }
            }
            catch(Exception Ex1)
            {

            }
        }
    }
}

Answer 1

你说得对。您所需要的只是连接到端口636。就这样。

在建立连接时，它所做的第一件事就是SSL握手(与HTTPS中发生的完全相同)。那么所有其他通信都是通过加密的连接完成的。

即使没有指定凭据，也会发送凭据。