ASP.NET & Microsoft Exchange: autentification and security practice
I'm writing service which will use for sending emails in my ASP.NET project. I tested two approaches for autentification on Exchange:
- Since my service is running under local user I allowed for it an anonymous access and pass login and password to Exchange Server.
- Another way is domain authorization on Exchange: before I invoke smtpClient.Send() method I impersonate(in code) an exist domain user with access rights to sender mailbox.
All of this ways works well but I really little confused how it should be as a good scenario. If I have a feature for sending mail on my ASP.NET site and Exchange Server -- what type of autentific开发者_如何学Cation on Exhcange user policy is preferable (1 or 2, ...)?
Option 3: Configure your service to run with a domain user account.
If so, this would be the preferred option, IMHO. Exchange can then be configured to allow access to a know domain user, avoiding the need to require anonymous access and, importantly, you don't have to secure away credentials in your service configuration in order to impersonate a domain user.
Indeed, you could configure your service to run under the security context of the user that you're impersonating.
精彩评论