预注册端口后仍无法以非管理员权限运行Owin自托管

我正在做一个PoC验证：能否通过预先以管理员权限完成端口/URL/防火墙配置，让Owin自托管应用无需管理员权限运行。为此我编写了FindAndReserveUrl和AddUrlReservation方法，通过netsh http add urlacl命令注册了端口（如http://+:6003/分配给Everyone，http://+:6004/分配给个人用户），但运行应用时仍抛出System.Net.HttpListenerException: Access is denied错误。检查URL注册记录确认已存在且端口匹配，请问还需哪些操作才能实现非管理员权限运行？

相关代码 #

public int FindAndReserveUrl(int startPort, int endPort)
{
    for (int port = startPort; port <= endPort; port++)
    {
        Console.WriteLine($"Checking port {port} availability...");
        if (IsPortAvailable(port))
        {
            Console.WriteLine($"Port {port} is available. Checking URL reservation...");
            string url = $"http://+:{port}/";
            var (output, error, exitCode) = ExecuteCommand("netsh", $"http show urlacl url={url}");

            // Considering a reservation non-existent if the output only contains the generic header
            // and no specific reservation details.
            bool noReservationExists = output.EndsWith("\n-----------------", StringComparison.InvariantCultureIgnoreCase);

            if (noReservationExists || exitCode != 0)
            {
                Console.WriteLine($"No existing URL reservation found for {url}. Proceeding to reserve.");
                AddUrlReservation(port, "Everyone");
                return port; // Successfully reserved this port.
            }
            else
            {
                Console.WriteLine($"Existing URL reservation detected for {url}, moving to next port...");
            }
        }
        else
        {
            Console.WriteLine($"Port {port} is in use, moving to next port...");
        }
    }

    Console.WriteLine("Failed to reserve a URL within the specified port range.");
    return -1; // Indicate failure to find and reserve
}

public void AddUrlReservation(int port, string user)
{
    string url = $"http://+:{port}/";
    // Prepare the command to add the URL reservation
    string addCommand = $"http add urlacl url={url} user={user}";

    // Execute the command and capture the output, error, and exit code
    var (output, error, exitCode) = ExecuteCommand("netsh", addCommand);

    // Provide feedback based on the command's execution result
    if (exitCode == 0)
    {
        // Success: Log the successful addition with any output provided
        Console.WriteLine($"Successfully added URL reservation for {url}.");
        if (!string.IsNullOrWhiteSpace(output))
        {
            Console.WriteLine($"Details: {output}");
        }
    }
    else
    {
        // Failure: Log the failure, including both the output and error information
        Console.WriteLine($"Failed to add URL reservation for {url}.");
        if (!string.IsNullOrWhiteSpace(output))
        {
            Console.WriteLine($"Output: {output}");
        }
        if (!string.IsNullOrWhiteSpace(error))
        {
            Console.WriteLine($"Error: {error}");
        }
    }
}

错误信息 #

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Net.HttpListenerException: Access is denied
   at System.Net.HttpListener.AddAllPrefixes()
   at System.Net.HttpListener.Start()
   at Microsoft.Owin.Host.HttpListener.OwinHttpListener.Start(HttpListener listener, Func`2 appFunc, IList`1 addresses, IDictionary`2 capabilities, Func`2 loggerFactory)
   at Microsoft.Owin.Host.HttpListener.OwinServerFactory.Create(Func`2 app, IDictionary`2 properties)
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Microsoft.Owin.Hosting.ServerFactory.ServerFactoryAdapter.Create(IAppBuilder builder)
   at Microsoft.Owin.Hosting.Engine.HostingEngine.Start(StartContext context)
   at Microsoft.Owin.Hosting.Starter.HostingStarter.Start(StartOptions options)
   at OwinNoAdminPoC.Program.Main(String[] args)

已确认的URL注册信息 #

Reserved URL            : http://+:6003/
        User: \\Everyone
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;WD)

    Reserved URL            : http://+:6004/
        User: [redacted]
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;[redacted])

以下是排查和解决权限问题的关键步骤：

• 严格匹配URL前缀
  Owin应用启动时绑定的URL必须和netsh预留的前缀完全一致，包括结尾的斜杠。比如预留的是http://+:6003/，应用就不能绑定http://+:6003（缺少斜杠），否则权限校验会失败。
• 验证用户权限生效情况
  虽然给Everyone分配了权限，但部分环境中Everyone组可能不包含当前运行用户的有效权限。可以尝试用具体的用户名（如DOMAIN\Username）替换Everyone，再重新执行预留命令。
• 检查HTTP.sys服务状态
  运行netsh http show servicestate查看是否有其他进程占用了该端口的HTTP.sys队列，或者存在冲突的URL预留。即使端口未被占用，HTTP.sys也可能因预留优先级问题拒绝访问。
• 重启HTTP.sys服务
  URL预留的变更有时需要重启HTTP.sys才能生效，执行命令：net stop http && net start http（注意：这会中断依赖HTTP.sys的服务，如IIS，仅在测试环境操作）。
• 核对应用绑定逻辑
  如果Owin应用绑定的是具体主机名（如http://localhost:6003/），而预留的是http://+:6003/，理论上兼容但可能出现权限问题。建议应用直接绑定和预留完全一致的前缀。

内容的提问来源于stack exchange，提问作者Vaethin