如何在 ASP.Net 应用程序中设置主体
我正在为客户编写一个网络应用程序。 用户将拥有一个一次性密钥，用于最初向应用程序表明自己的身份。 一旦应用程序验证密钥有效，就会将他们带到一个页面，他们可以在其中创建一个普通帐户以用于所有后续登录。 创建帐户页面只能在输入密钥后才能访问，否则无法访问。 即，使用普通帐户登录的用户不应该访问它。 这是使用自定义成员资格提供程序的 asp.net 3.0。
我的计划是根据密钥创建一个临时帐户并使用该帐户对用户进行身份验证。 这允许他们访问创建用户页面（受位置标签保护），他们可以在其中创建正式帐户。 然后我使用他们的新帐户对他们进行身份验证并删除临时帐户。 流程是：用户转到输入密钥的页面。 如果密钥有效，我将创建临时帐户，调用 FormsAuthentication.SetAuthCookie，然后重定向到创建帐户页面。 这一切都有效，尽管看起来有点复杂。
问题是创建用户页面可供任何经过身份验证的用户使用； 我只希望它在输入密钥和创建正式帐户之间的时间内可用。 因此，我想为临时帐户创建一个特殊角色，并使创建用户页面只能由该角色访问，而不能由其他角色访问。 我创建了自己的具有特殊角色的主体对象，并尝试在验证临时帐户时设置它，但我无法让它工作。
我真的希望我不必编写自定义角色提供程序来执行此操作。
我怎样才能做到这一点？ 必须有一个更简单的方法！
I am writing a web app for a client. Users will have a one-time key that they will use to initially identify themselves to the app. Once the app verifies that the key is valid it will take them to a page where they can create a normal account to use for all subsequent logins. The create-account page should only be accessible after entering the key and shouldn't be accessible otherwise. I.e, it shouldn't be accessible to users logged in with a normal account.
This is asp.net 3.0 using a custom membership provider.
My plan is to create a temporary account based on the key and authenticate the user with that account. This allows them access to the create-user page (which is protected with a location tag ) where they can create the formal account. I then authenticate them with their new account and delete the temporary account.
The flow is: the user goes to a page where they enter the key. If the key is valid I create the temporary account, call FormsAuthentication.SetAuthCookie, and redirect to the create-account page. This all works, although it seems a little complicated.
The problem is that the create-user page is available to any authenticated user; I only want it available during the time between entering the key and creating the formal account. So I thought I'd create a special role for the temporary account and make the create-user page accessible only to that role and none other. I created my own Principal object with a special role and tried setting it when I authenticate the temporary account but I can't get that to work.
I'm really hoping I don't have to write a custom role provider just to do this.
How can I make this work? There's gotta be a simpler way!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
为什么不在输入密钥时简单地创建真实帐户呢？ 为其分配一些随机名称，然后让他们更改名称和其他详细信息。 那么你就不需要创建用户页面，只需要输入密钥页面和帐户详细信息编辑页面。 如果您担心填写帐户详细信息，您可以进行设置（可能通过母版页上的代码），以便在输入详细信息之前，不完整的帐户始终会重定向到编辑详细信息页面。
或者，您可以让他们在输入密钥页面上输入除密钥代码之外的所需详细信息，并在创建帐户时简单地使用这些详细信息。
Why not simply create the real account when they enter the key. Assign it some random name and then let them change the name and other details. Then you don't need the create user page, just the enter key page and an account details editing page. If you're concerned about getting the account details filled in, you could set it up (perhaps via code on a MasterPage) so that incomplete accounts always get redirected to the edit details page until the details are entered.
Or, you could have them enter the required details in addition to the key code on the enter key page and simply use those details when creating the account.
我的建议是在验证用户时避免使用临时帐户。 相反，生成您自己的逻辑来验证注册密钥。 然后，在页面的头部，您可以检查用户是否是经过身份验证的用户（已调用SetAuthCookie），如果是则跳转到不同的页面。
您甚至可以更改页面访问权限以禁止经过身份验证的用户访问此页面（我知道您可以禁用未经身份验证的用户的帐户，但我不确定您是否可以采取其他方向）。
但关键是要避免在用户实际上还不是会员时依赖会员提供商！
My advice would be to avoid the use of temporary accounts when validating the user. Instead, generate your own logic for validating the sign-up key. Then, at the head of the page, you can check whether the user is an authenticated user (SetAuthCookie has been called) and jump to a different page if this is true.
You may even be able to change the page access to forbid this page to authenticated users (I know you can disable accounts for unauthenticated users but I'm not sure if you can go the other direction).
The key, though, is to avoid relying on the membership provider when, in fact, the user is not yet a member!
在针对临时令牌进行身份验证时分配“不完整”角色，然后将访问限制为仅该角色...创建帐户后，将它们发送到重新登录页面（终止身份验证令牌）。 这将简化您的安全模型。
Assign an "incomplete" role when authenticating against the temporary token, then restrict access to only that role... when the account is created, send them to a re-login page (terminating the authentication token). This will simplify your security model.