ASP.Net MVC 会员资格
我想使用 AuthorizeAttribute 来控制允许哪些用户访问我的操作。我只是想澄清一下我的逻辑是正确的。
- 我创建了自己的 IPrincipal 实现，
- 并将用户的凭据发布到安全控制器的登录操作。
- 我使用 UserService 类验证凭据，并将从 UserService 类返回的 IPrincipal 分配给 HttpContext.User
- 我的 WebAuthorizeAttribute（它继承 AuthorizeAttribute）检查当前的 HttpContext.User.Identity.IsAuthenticated 和 HttpContext.User.IsInRole 以确定用户是否具有访问该操作。
事情的发展是正常的吗？我知道我可以继承 MembershipProvider，但我不需要那里的所有功能，实际上只是使用两个不同角色登录的能力。
I want to use the the AuthorizeAttribute to control which users are allowed access to my actions. I just want to clarify that my logic is in order.
- I create my own implementation of IPrincipal
- I post a user's credentials to a login action of a security controller.
- I validate the credentials with a UserService class and assign the IPrincipal returned from my UserService class to HttpContext.User
- My WebAuthorizeAttribute, which inherits AuthorizeAttribute, checks the current HttpContext.User.Identity.IsAuthenticated and HttpContext.User.IsInRole to determine if the user has access to the action.
Is the the normal flow of things? I know I could inherit MembershipProvider, but I don't need all of the functionality there, really just the ability to login with two different roles.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您必须将 IPrincipal 存储在某处，并在每次请求时恢复它。如果您将使用 FormsAuthentication，这是一个很好的解决方案：
ASP.NET 2.0 Forms 身份验证 - 保持自定义但简单
您可以在此处找到其他解决方案：
使用表单身份验证在 ASP.NET MVC 上的何处存储记录的用户信息？
并且可能在许多其他 StackOverflow 问题中:)
编辑
关于 MyBusinessLayerSecurityClass.CreatePrincipal(id, id.Name)：
您应该阅读此页面：
http://msdn.microsoft.com/en-us/library/aa480476.aspx
特别是这个：
设置身份验证 cookie 后，FormsIdentity 会自动管理。您所要做的就是将其包装在您的 IPrincipal 中。当 HttpContext.Current.User 属性不为 null（它是 GenericPrincipal，不久后您将替换它）时，所有这些都会发生。当 HttpContext.Current.User 为 null 时，则之前没有创建身份验证 cookie，并且用户未经过身份验证。
You'll have to store IPrincipal somewhere and restore it with every request. If you'll use FormsAuthentication, this is good solution:
ASP.NET 2.0 Forms authentication - Keeping it customized yet simple
you can find other solutions here:
Where to store logged user information on ASP.NET MVC using Forms Authentication?
and propably in many other StackOverflow questions:)
EDIT
About MyBusinessLayerSecurityClass.CreatePrincipal(id, id.Name):
You should read this page:
http://msdn.microsoft.com/en-us/library/aa480476.aspx
Specially this:
FormsIdentity is managed automatically after you set authentication cookie. All you have to do is wrap it up in your IPrincipal. All this happens when HttpContext.Current.User property is not null (it is GenericPrincipal, which you replace shortly after). When HttpContext.Current.User is null then there was no authentication cookie created earlier and user is not authenticated.
我认为以下情况更为典型：
I believe the following is more typical: