面对双跳，我们应该使用交换模拟或Kerberos委托

We have Sharepoint 2010 environment with AD windows authenticated users, we want to display user's unread inbox email count from exchange server 2007, but unfortunately we are facing double hop as i asked this question here, after doing a bit more research it seems we have only two solutions

我们有Sharepoint 2010环境，有AD windows认证的用户，我们想显示用户未读的来自exchange server 2007的收件箱数量，但不幸的是，当我在这里问这个问题时，我们面临着双重打击，在做了更多的研究之后，我们似乎只有两个解决方案

1- Use Exchange Impersonation:

1 -使用外汇模拟:

My Concern : Our user have highly classified information in their inbox, so with Exchange Impersonation can we programmers will become a security risk ? or is impersonation occurs for only currently logged in windows authenticated user.....to put it simply, Is Exchange impersonation secure enough for my case ?

我的担心是:我们的用户在他们的收件箱中有高度机密的信息，因此，通过交换模拟，我们程序员能成为安全风险吗?或者是仅对当前登录在windows认证的用户进行模拟……简单地说，交换模拟对我的情况是否足够安全?

2- Use Kerberos Delegation :

2-使用Kerberos委托:

I know its the right way but we could not configure it, Can anyone help me by providing simple step by step guide for Kerberos delegation setup for my case, as we do every right but double hop still occurs.

我知道这是正确的方式，但我们无法配置它，任何人都可以为我的例子提供简单的Kerberos委托设置步骤指南，因为我们做的每一项工作都是正确的，但仍然会出现双跳。

1 个解决方案

#1

Delegation seems like the cleaner solution here. You'd need to get your Exchange admins to setup an Alternate Service Account (ASA) for Exchange to use so that you can use Kerb AuthN with it. From there, you'd need to configure the Sharepoint service accounts to delegate to the http/foo.domain.com SPN on the ASA.

委托似乎是一个更干净的解决方案。您需要让Exchange管理员设置一个备用服务帐户(ASA)来交换使用，以便您可以使用它。从那里，您需要配置Sharepoint服务帐户，将其委托给ASA上的http/foo.domain.com SPN。