表单身份验证：子目录有不同的凭据？
我的网站有表单身份验证，一切都很好。现在我想创建一个子目录并对其进行密码保护，但是！我需要该子目录使用与整个网站使用的一组完全不同的登录名/密码。
例如，我将网站的用户存储在数据库的“用户”表中。但对于子目录，我希望从“SubdirUsers”表中获取用户。它可能具有完全不同的结构。
因此，我需要完全并行的登录，如下所示：
- 登录整个网站并不会让您也登录到子目录
- 在整个网站上单击“注销”不会使您在子目录中的登录无效
- 反之亦然
我 <不想为子目录创建单独的虚拟应用程序，因为我想共享所有库、用户控件以及应用程序状态和缓存。换句话说，它必须是同一个应用程序。
我也不想只想向“用户”表添加一个标志，指示这是整个网站用户还是子目录用户。用户列表必须来自不同的来源。
目前，我看到的唯一选项是为子目录推出我自己的 Forms Auth。
有人可以提出更好的选择吗？
My website has forms authentication, and all is well. Now I want to create a subdirectory and have it also password-protected, but! I need the subdirectory to use a completely different set of logins/passwords than the whole website uses.
Say, for example, I have users for the website stored in the "Users" table in a database. But for the subdirectory, I want the users to be taken from the "SubdirUsers" table. Which probably has a completely different structure.
Consequently, I need the logins to be completely parallel, as in:
- Logging into the whole website does not make you logged into the subdirectory as well
- Clicking "logout" on the whole website does not nullify your login in the subdirectory
- And vice versa
I do not want to create a separate virtual application for the subdirectory, because I want to share all libraries, user controls, as well as application state and cache. In other words, it has to be the same application.
I also do not want to just add a flag to the "Users" table indicating whether this is a whole website user or the subdirectory user. User lists have to come from different sources.
For now, the only option that I see is to roll my own Forms Auth for the subdirectory.
Anybody can propose a better alternative?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
我认为您可以使用此代码来验证任何提供商的用户
I think you can use this code to validate user with any provider
您可以在子文件夹中拥有一个单独的 web.config 文件，其中仅包含该子文件夹的验证设置。请注意，您必须删除所有其他设置，因为有些设置只能在应用程序级别上进行。
You can have a separate web.config file in the subfolder that includes only the validiation settings for that subfolder. Note that you must remove all the other settings, as there are some settings that can only be on application level.
仅使用 FormsAuthentication 根本无法实现此目的。
此问题场景非常适合使用 HttpModule。 HttpModules 可以拦截请求和响应管道。您将需要编写 2 个 HttpModule。
一旦您的解决方案达到稳定状态并且您能够很好地管理复杂性，您就可以将这些模块合并为一个。
在您的解决方案中，您将需要一个数据库机制来存储子目录以及用户授权和身份验证映射数据。您的 HttpModule 可以读取这些数据来做出有关请求用户的决定。
您可以从此处开始。
You will simply not be able to achieve this with FormsAuthentication only.
This problem scenario is perfect candidate for using HttpModules. HttpModules can intercept the Request and Response pipeline. You will need to write 2 HttpModules.
You can merge these modules into one later once your solution reaches in stable state and you are fairly able to manage the complexity.
In your solution, you will need to have a database mechanism that stores the subdirectory and user authorization and authentication mapping data. Your HttpModules can read these data take decision about the Requesting user.
You can start from here.
如果您的用户位于 web.config 文件中，我可以看到更好的答案，但由于您在数据库中使用用户，因此您几乎必须使用表单身份验证之外的其他内容。您需要设置子目录以允许任何用户，然后基本上使用会话重建表单身份验证。您可以创建页面类的子类，并使用它来保存所有例程以进行身份验证和重定向。这样您就不需要向子目录中的每个页面添加任何内容。
我知道这是您可能希望避免的答案，但是对于这种复杂的情况，表单身份验证的解决方案太简单了。
I could see a better answer if your users were in the web.config file, but since you're using users in a database you're pretty much going to have to use something besides forms Authentication. You'll need to set the sub directory to allow any users and then basically rebuild forms Authentication with sessions. You could make a sub class of the page class and use it to hold your all your routines to authenticate and redirect. Then you won't need to add anything to every page in the sub directory.
I know this is the answer you were probably hoping to avoid but forms Authentication is too simple a solution for this kind of complicated situation.
这可以帮助您 - numina.codeplex.com
This can help you - numina.codeplex.com
通常“授权”是在登录后使用来确定给定用户可以使用哪些目录、资源等。
您是否考虑过为“主”目录创建一个角色，为“子”目录创建第二个角色，然后应用授权标签（即在 web.config 中）？您将需要实现一个授权提供程序，但这听起来可能是比拥有多个用户表更好的长期解决方案。
澄清无论授权如何（即凭据检查或密码等），您仍然需要在某处定义用户角色，因此为了便于论证，我们假设一个“用户表”。 （如果您愿意，没有什么可以阻止它成为独立存储中的 XML 文件。）
NB 用户来自不同来源实际上并不重要。这应该反映在用户表的架构中（即标志或另一列等）。如果你与这种常见模式作斗争，从长远来看，你可能会做更多的工作。
当出现一个例外时，将来很可能会出现另一个......
Usually "authorization" is used after login to determine which directories, resources, etc can be used by the given user.
Have you looked at creating a role for the "main" directory and a second role for the "sub" directory and then applying the authorization tag (i.e. in the web.config)? You will need to implement an authorization provider, but that sounds like it might be a better long term solution than having multiple user tables.
Clarification Regardless of authorization (i.e. credential check or password, etc) you would still need to define the user roles somewhere, so for the sake of argument lets assume a "user table". (Nothing stops this from being an XML file in isolated storage if you wish.)
NB It doesn't actually matter that the users come from different sources. This should be reflected in the schema for the user table (i.e. a flag or another column, etc). If you fight this common pattern you will likely end up doing more work in the long run.
When there is one exception, there is likely to be another in the future....
我没有尝试过这个，但我认为它会起作用。
您可以有两个成员资格提供程序（即 ASPNETDB_1 和 ASPNETDB_2）。
它们在 web.config 的成员资格提供程序部分中指定。所以你需要在每个子目录中有一个单独的 web.config，我知道你可以做到。
在网站的根目录中，我猜您不会进行表单身份验证。您可以只有一个起始页，要求用户选择哪个子目录（或者您可以只使用子域（firstdir.mysite.com、secondir.mysite.com）或http:/mysite.com/firstdirectory 或http:/mysite。 不过，
我不确定此方法相对于虚拟目录的优势，只是根目录可以包含一些不需要身份验证的 ASP 程序。
我知道您正在寻找“开箱即用”的解决方案 。并且不想“推出您自己的”但是；标准会员资格提供商确实允许您为每个用户建立个人资料 - 那么为每个单独的用户设置一个带有列表视图的用户维护表单真的很容易。维护功能并按角色或按配置文件值（例如，组织 ID）进行过滤，我个人发现这非常容易开箱即用（如果使用所有拖放，创建维护表单可能需要一个小时）。控件、SqlDatasource + listview——无需 VB 或 C 编码）。但是，单独的提供程序和 webconfigs 也可以做到这一点。
I've not tried this but I think it would work.
You can have two membership providers (i.e., ASPNETDB_1 and ASPNETDB_2.)
These are specified in the membership provider section of the web.config. So you need a separate web.config in each subdirectory, which I know you can do.
In the root of the site I guess you would not have forms authentication. You could have just a start page that asks the user to choose which subdirectory (or you can just use subdomains (firstdir.mysite.com, secondir.mysite.com) or http:/mysite.com/firstdirectory or http:/mysite.com/secondirectory.
I am not sure of the advantage of this method over virtual directories, though, except that the root can contain some ASP programs that don't require authentication.
I understand you are looking for an "out of the box" solution and don't want to "roll your own". However;the standard membership provider does allow you to establish a profile for each user -- then it is really easy to setup one user maintenance form with a listview for each of your separate users maintenance functions and filter by role or by profile value (e.g., organizational ID). Using the membership provider classes, I personally found this very easy to do out of the box (maybe an hour of creating maintenane forms if that using all drag/drop controls, SqlDatasource + listview -- no VB or C coding required). But, separate providers and webconfigs would do the trick as well.