如何使用 activedirectorymembershipprovider 在 asp.net mvc 应用程序中实现角色层次结构
在我的 asp.net mvc 应用程序中，我使用的是 activedirectorymembershipprovider。 在活动目录中，为了简单起见，我创建了几个类似于“普通”和“管理员”的角色（组）。
我目前正在通过获取 httpcontext 的 IPrincipal 并调用 User.IsInRole(nameOfRoleGoesHere); 来查询用户是否处于角色中。
我正在寻找的行为是让我能够询问用户是否处于“管理员”角色，然后隐式询问用户是否处于该角色之下的所有角色（在这种情况下，角色“正常”将低于“管理员”）。 由于我的角色主要是垂直的（如果这有意义的话），这种角色继承似乎对我目前的应用程序有意义。
我怎样才能得到这种行为 - 我必须实现一些自定义逻辑，允许我请求角色“管理员”，但抽象出实际上在幕后的活动目录中请求“正常”和“管理员” - 或者是否有可能活动目录中的结构组以某种方式自动给我这种行为？
对于我对 ASP.NET、Active Directory 和 .NET 安全性的任何严重误解表示歉意 - 我是菜鸟并正在尝试。
In my asp.net mvc app i am using the activedirectorymembershipprovider. In the active directory i have created a couple of roles (groups) similar to, for simplicity of this example, "normal" and "administrator".
I am currently querying whether user is in role by getting the IPrincipal of the httpcontext and calling User.IsInRole(nameOfRoleGoesHere);.
The behaviour im looking for is for me to be able to ask whether user is in role "administrator" and then implicitly be asking whether user is in all roles below that (in this case role "normal" would be below "administrator").
As my roles are mainly vertical (if that makes any sense) this kind of role-inheritance seems to make sense for my application at the moment.
How can i get this behavior - must i implement some custom logic allowing me to ask for role "administrator", but abstracting away actually asking for both "normal" and "administrator" in the active directory behind the scenes - or is it possible to structure groups in active directory somehow giving me this behaviour automatically?
Apologies for any gross misunderstandings of asp.net, active directory and .net security on my part - i am rookie and experimenting.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
AD 支持一个组是另一个组的成员的概念吗？
因此，您可以拥有以下内容：
用户： Anne、Bob、Charlie、Douglas、Elliot、Fred 和 George。
角色：普通、编辑、管理员
然后将每个组定义为：
管理员具有以下成员：乔治
编辑具有以下成员：“ Admin”、Douglas、Elliot
Normal 有以下成员：“Editor”、“Admin”、Anne、Bob、Charlie
因此，您知道 George 是 Normal、Editor 和 Admin 的成员，因为所有Admin 的成员包含在这些组中，而 Douglas 只是 Editor 和 Normal 的成员，Anne 只是普通用户，AD 会说“是的，George 是普通用户”，如果您它问道。
但是：（据我所知）没有一个官方的、微软支持的 ActiveDirectory RoleProvider 可以用正确的 AD 角色填充 RolesPrinciple - 有几个像 CodePlex 上的这个 您将什么定义为您的角色提供者？
默认的 ASP.NET 角色提供程序不支持角色层次结构，因此您需要执行以下任一操作：
AD supports the concept of a group being a member of another group?
So you could have the following:
Users: Anne, Bob, Charlie, Douglas, Elliot, Fred and George.
Roles: Normal, Editor, Admin
Then in the define each group as:
Admin has the following members: George
Editor has the following members: "Admin", Douglas, Elliot
Normal has the following members: "Editor", "Admin", Anne, Bob, Charlie
Therefore, you know that George is a member of Normal, Editor and Admin, because all members of Admin are included in those groups, while Douglas is only a member of Editor and Normal, and Anne is just a Normal user, and AD would say "yes, George is a Normal user" if you asked it.
HOWEVER: There isn't (as far as I know) an offical, MS supported ActiveDirectory RoleProvider that would populate the RolesPrinciple with the correct AD roles - there are a couple out there like this one on CodePlex what have you defined as your role provider?
The default ASP.NET role provider doesn't support role hierarchies, so you would either need to either:
Active Directory 实际上没有成员资格层次结构的概念。 用户是一个、多个、许多组的成员 - 但仅此而已。 他是“管理员”组的成员 - 是或否。 他也可能是 A 组、B 组、F 组和 M 组的成员 - 但并不存在您所寻找的真正的“角色层次结构”。
我想，在某种程度上，在我看来，能够组合任意数量的组成员身份可能比拥有层次结构更加灵活和可靠。
马克
Active Directory really doesn't have a concept of a hierarchy in terms of membership. A user is member of one, several, many groups - but just that. He's member of the "Admin" group - yes or no. He might also be member of GRoup A, Gropu B, Group F and Group M - but there's no real "role hierarchy" as you're looking for.
I guess, in a way, having the ability to just combine any number of group memberships is probably even more flexible and reliable than having a hierarchy, in my opinion.
Marc