为什么使用 DirectoryEntry 对 LDAP 进行身份验证会间歇性地抛出 COMException (0x8007203A):“服务器无法运行"?

本文介绍了为什么使用 DirectoryEntry 对 LDAP 进行身份验证会间歇性地抛出 COMException (0x8007203A):“服务器无法运行"?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

如果有人有类似的故事，请在下面发布详细信息！

我正在构建一个 ASP.NET 网站，它需要支持针对 LDAP 的身份验证.

I'm building an ASP.NET website which needs to support authentication against LDAP.

在 Windows 上，可以通过 Active Directory 执行 LDAP 身份验证(我不是专家，但 AD 似乎只是 ldap 的一种特殊形式).我不控制 AD 和/或 LDAP 服务器.

On windows, LDAP auth can be performed via Active Directory (I'm no expert, but AD seems to simply be a particular flavor of ldap). I don't control the AD and/or LDAP servers.

我尝试了各种身份验证方法，但我决定每次身份验证尝试使用单个 DirectoryEntry:

I've tried various methods of authentication, but I've settled on using a single DirectoryEntry per authentication attempt:

using (DirectoryEntry de = new DirectoryEntry(ldapPath, ldapUsername, password, AuthenticationTypes.ServerBind)) {
    try {
        // Bind to the native AdsObject to force authentication.
        object obj = de.NativeObject;//not IDisposable
    } catch(...

如果出现任何问题，检索 NativeObject 会导致 COMException，例如，如果身份验证失败，则异常类似于登录失败:未知用户名或密码错误"，如果 ldap服务器无法访问或超时，例如服务器无法运行".

Retrieving the NativeObject causes a COMException if anything whatsoever goes wrong, for instance if the authentication failed, the exception is something like "Logon failure: unknown user name or bad password", and if the ldap server is unreachable or times out, something like "The server is not operational."

这基本上是可行的，但是在可变天数之后，总是从早上的第一件事开始，我们得到服务器无法运行".直到 IIS 重新启动.这显然不是一个很好的长期解决方案，但据我所知，问题在于底层 DirectoryEntry 的 Com 对象 - 不容易修复.

This works, basically, but after variable number of days, always starting first thing in the morning, we get "The server is not operational." until IIS is restarted. This is obviously not a great long-term solution, but as far as I can tell the fault lies with the Com Object underlying DirectoryEntry - not something easy to fix.

这个问题不是新或未知.有些人通过微软的支持，结果喜忧参半；基本上答案似乎归结为采用您的 ldap 路径并创建一些等效的替代方案，也许其中一个会起作用".每次你尝试，或者当然，你不会知道它是否真的有效，直到找到真正的解决方案，我们才回到每晚重新启动 Windows 服务器".

This problem isn't new or unknown. Some people have gone through microsoft's support with mixed results; basically the answers seem to come down to "take your ldap path and create a few equivalent alternatives and maybe one of those will work". Each time you try, or course, you won't know for a few days whether it actually worked, and until a real solution is found, we're back to "reboot the windows servers every night".

首先，我尝试了 ldap 路径的格式

As a start, I've tried ldap paths in the format

* "LDAP://server.uri:636"
* "LDAP://insecure.server.uri:389"
* "LDAP://server.uri:636/cn=username,ou=staff,o=myOrganisation,c=org"

始终使用具有以下模式的用户名:

Always with a username with the following pattern:

* "cn=username,ou=staff,o=myOrganisation,c=org"

所有这些方法最初都有效，但在可变天数后失败(并在 IIS 重置后开始工作).服务器在 win 2k3 上运行 IIS6.

All of these methods work initially, but fail after a variable number of days (and start working after an IIS reset). The server is running IIS6 on win 2k3.

如果其他人有这些问题，请在下面发布，也许最终我们会找到一种可以使用的模式或有足够数量的示例来说服微软解决这个问题.

If anyone else has these problems, please post below, and perhaps eventually we'll find a pattern to work with or have sufficient number of examples to convince microsoft to fix this.

为什么使用 DirectoryEntry 对 LDAP 进行身份验证会间歇性地抛出 COMException (0x8007203A):“服务器无法运行"?

问题描述

推荐答案

相关文档推荐