返回

如何在 C# 中实现 Windows 身份验证窗口？

windows

如何在 C# 中调用类似 Chrome 的 Windows 身份验证窗口？

你是否曾想过在自己的 C# 应用程序中实现类似 Chrome 浏览器那样的 Windows 身份验证窗口？这种简洁安全的登录方式能够极大地提升用户体验。本文将探讨如何在 C# 中调用 Windows 身份验证窗口，并提供可供参考的代码示例，帮助你轻松实现这一功能。

抛砖引玉：Windows 身份验证

很多开发者希望在 C# 应用程序中集成 Windows 身份验证，以简化用户登录流程，并增强安全性。然而，直接调用 Windows API 实现这一功能可能会比较复杂，需要处理大量的底层细节。有没有更简单的解决方案呢？

.NET Framework：自带解决方案

.NET Framework 和 .NET Core 为我们提供了一种便捷的方式——NegotiateStream 类，它可以用于实现基于协商的身份验证，包括 Windows 身份验证。

NegotiateStream：幕后英雄

NegotiateStream 类允许客户端和服务器协商使用哪种身份验证协议。在 Windows 环境下，它通常会默认使用 Kerberos 协议进行身份验证，如果 Kerberos 协议不可用，则会回退到 NTLM 协议。

下面是一个简单的示例，演示了如何使用 NegotiateStream 类实现 Windows 身份验证：

服务器端代码 (C#):

using System;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationServer
{
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        TcpListener listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();
        Console.WriteLine(
using System;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationServer
{
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        TcpListener listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();
        Console.WriteLine($"Server started on port {Port}.");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = ProcessClientAsync(client);
        }
    }

    private static async Task ProcessClientAsync(TcpClient client)
    {
        using (client)
        using (NetworkStream stream = client.GetStream())
        {
            try
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsServerAsync();

                // 获取客户端身份信息
                IIdentity clientIdentity = authStream.RemoteIdentity;
                Console.WriteLine($"Client authenticated: {clientIdentity.Name}");

                // 发送响应消息
                string responseMessage = $"Hello, {clientIdentity.Name}!";
                byte[] responseBytes = Encoding.UTF8.GetBytes(responseMessage);
                await authStream.WriteAsync(responseBytes, 0, responseBytes.Length);
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

quot;Server started on port {Port}.");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = ProcessClientAsync(client);
        }
    }

    private static async Task ProcessClientAsync(TcpClient client)
    {
        using (client)
        using (NetworkStream stream = client.GetStream())
        {
            try
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsServerAsync();

                // 获取客户端身份信息
                IIdentity clientIdentity = authStream.RemoteIdentity;
                Console.WriteLine(
using System;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationServer
{
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        TcpListener listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();
        Console.WriteLine($"Server started on port {Port}.");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = ProcessClientAsync(client);
        }
    }

    private static async Task ProcessClientAsync(TcpClient client)
    {
        using (client)
        using (NetworkStream stream = client.GetStream())
        {
            try
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsServerAsync();

                // 获取客户端身份信息
                IIdentity clientIdentity = authStream.RemoteIdentity;
                Console.WriteLine($"Client authenticated: {clientIdentity.Name}");

                // 发送响应消息
                string responseMessage = $"Hello, {clientIdentity.Name}!";
                byte[] responseBytes = Encoding.UTF8.GetBytes(responseMessage);
                await authStream.WriteAsync(responseBytes, 0, responseBytes.Length);
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

quot;Client authenticated: {clientIdentity.Name}");

                // 发送响应消息
                string responseMessage = 
using System;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationServer
{
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        TcpListener listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();
        Console.WriteLine($"Server started on port {Port}.");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = ProcessClientAsync(client);
        }
    }

    private static async Task ProcessClientAsync(TcpClient client)
    {
        using (client)
        using (NetworkStream stream = client.GetStream())
        {
            try
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsServerAsync();

                // 获取客户端身份信息
                IIdentity clientIdentity = authStream.RemoteIdentity;
                Console.WriteLine($"Client authenticated: {clientIdentity.Name}");

                // 发送响应消息
                string responseMessage = $"Hello, {clientIdentity.Name}!";
                byte[] responseBytes = Encoding.UTF8.GetBytes(responseMessage);
                await authStream.WriteAsync(responseBytes, 0, responseBytes.Length);
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

quot;Hello, {clientIdentity.Name}!";
                byte[] responseBytes = Encoding.UTF8.GetBytes(responseMessage);
                await authStream.WriteAsync(responseBytes, 0, responseBytes.Length);
            }
            catch (Exception ex)
            {
                Console.WriteLine(
using System;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationServer
{
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        TcpListener listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();
        Console.WriteLine($"Server started on port {Port}.");

        while (true)
        {
            TcpClient client = await listener.AcceptTcpClientAsync();
            _ = ProcessClientAsync(client);
        }
    }

    private static async Task ProcessClientAsync(TcpClient client)
    {
        using (client)
        using (NetworkStream stream = client.GetStream())
        {
            try
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsServerAsync();

                // 获取客户端身份信息
                IIdentity clientIdentity = authStream.RemoteIdentity;
                Console.WriteLine($"Client authenticated: {clientIdentity.Name}");

                // 发送响应消息
                string responseMessage = $"Hello, {clientIdentity.Name}!";
                byte[] responseBytes = Encoding.UTF8.GetBytes(responseMessage);
                await authStream.WriteAsync(responseBytes, 0, responseBytes.Length);
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

quot;Error: {ex.Message}");
            }
        }
    }
}

客户端代码 (C#):

using System;
using System.Net.Security;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationClient
{
    private const string ServerAddress = "localhost";
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        try
        {
            using (TcpClient client = new TcpClient(ServerAddress, Port))
            using (NetworkStream stream = client.GetStream())
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsClientAsync();

                // 发送请求消息
                string requestMessage = "Hello from client!";
                byte[] requestBytes = Encoding.UTF8.GetBytes(requestMessage);
                await authStream.WriteAsync(requestBytes, 0, requestBytes.Length);

                // 接收响应消息
                byte[] buffer = new byte[1024];
                int bytesRead = await authStream.ReadAsync(buffer, 0, buffer.Length);
                string responseMessage = Encoding.UTF8.GetString(buffer, 0, bytesRead);

                Console.WriteLine(
using System;
using System.Net.Security;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationClient
{
    private const string ServerAddress = "localhost";
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        try
        {
            using (TcpClient client = new TcpClient(ServerAddress, Port))
            using (NetworkStream stream = client.GetStream())
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsClientAsync();

                // 发送请求消息
                string requestMessage = "Hello from client!";
                byte[] requestBytes = Encoding.UTF8.GetBytes(requestMessage);
                await authStream.WriteAsync(requestBytes, 0, requestBytes.Length);

                // 接收响应消息
                byte[] buffer = new byte[1024];
                int bytesRead = await authStream.ReadAsync(buffer, 0, buffer.Length);
                string responseMessage = Encoding.UTF8.GetString(buffer, 0, bytesRead);

                Console.WriteLine($"Server response: {responseMessage}");
            }
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Error: {ex.Message}");
        }
    }
}

quot;Server response: {responseMessage}");
            }
        }
        catch (Exception ex)
        {
            Console.WriteLine(
using System;
using System.Net.Security;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;

public class AuthenticationClient
{
    private const string ServerAddress = "localhost";
    private const int Port = 8080;

    public static async Task Main(string[] args)
    {
        try
        {
            using (TcpClient client = new TcpClient(ServerAddress, Port))
            using (NetworkStream stream = client.GetStream())
            {
                // 创建 NegotiateStream 实例
                NegotiateStream authStream = new NegotiateStream(stream, false);

                // 进行身份验证
                await authStream.AuthenticateAsClientAsync();

                // 发送请求消息
                string requestMessage = "Hello from client!";
                byte[] requestBytes = Encoding.UTF8.GetBytes(requestMessage);
                await authStream.WriteAsync(requestBytes, 0, requestBytes.Length);

                // 接收响应消息
                byte[] buffer = new byte[1024];
                int bytesRead = await authStream.ReadAsync(buffer, 0, buffer.Length);
                string responseMessage = Encoding.UTF8.GetString(buffer, 0, bytesRead);

                Console.WriteLine($"Server response: {responseMessage}");
            }
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Error: {ex.Message}");
        }
    }
}

quot;Error: {ex.Message}");
        }
    }
}

这段代码演示了如何使用 NegotiateStream 类在客户端和服务器之间进行 Windows 身份验证。需要注意的是，这段代码只是一个简单的示例，实际应用中可能需要根据具体需求进行修改和完善。

使用 NegotiateStream 的优势

  • 安全性高 : 利用 Kerberos 或 NTLM 协议进行身份验证，有效防止中间人攻击等安全威胁。
  • 易于实现 : .NET 框架提供了现成的类库，无需开发者自行处理复杂的底层逻辑。
  • 用户体验好 : 用户无需再次输入用户名和密码，即可完成身份验证。

常见问题解答

1. NegotiateStream 是否支持其他身份验证协议？

除了 Kerberos 和 NTLM，NegotiateStream 还支持其他身份验证协议，例如协商 TLS (Negotiate TLS)。

2. 如何在 ASP.NET Core 应用程序中使用 NegotiateStream？

在 ASP.NET Core 中，可以使用 Negotiate 身份验证方案来启用 Windows 身份验证。

3. 如何自定义 Windows 身份验证窗口的外观？

Windows 身份验证窗口的样式由操作系统控制，开发者无法直接自定义其外观。

4. 如何处理 Windows 身份验证失败的情况？

可以使用 try-catch 块捕获身份验证过程中抛出的异常，并根据需要进行处理。

5. 如何在非 Windows 平台上使用 Windows 身份验证？

Windows 身份验证依赖于 Windows 操作系统提供的功能，无法在非 Windows 平台上直接使用。

总结

通过以上步骤，你可以在 C# 应用程序中轻松实现类似 Chrome 的 Windows 身份验证窗口，提高应用程序的安全性，并提供更便捷的用户体验。