ASP.NET 会员替代方案
我一直远离 ASP.NET 会员，因为它看起来很臃肿，而且（当时）无法测试。特别是在 asp.net MVC 的情况下，是否有人使用替代解决方案来为用户分配角色，并为登录用户存储一些附加信息？有什么推荐吗？自己推出、实现您需要的功能是不是很疯狂？
I have always stayed away from asp.net membership as it seemed bloated, and (at the time) untestable. In the case of asp.net MVC specifically, does anyone use an alternative solution for assigning roles to users, and storing some addition information for the logged in user? Any recommendation? Is it crazy to just roll your own, just implementing the functionality you need?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
ASP.NET 成员资格使用提供者模型进行存储。 SqlMembershipProvider 从抽象 MembershipProvider 类继承加密/散列密码功能。但如果您愿意，您也可以从 MembershipProvider 继承并在自定义提供程序中获取该功能。
如果您使用 SqlMembershipProvider，您将获得一个完全工作的成员数据库，具有完整的密码管理（检查、更改、重置、无效密码尝试）和用户管理（CRUD 操作、锁定用户）。
所有这些都在 API 级别。您可以根据 API 创建任何您想要的 UI。
使用 SqlMembershipProvider 不需要您使用角色提供程序或配置文件提供程序或任何其他内容，并且您可以自行完成这些内容，而不会影响成员身份。至少我建议使用经过充分测试的 SqlMembershipProvider 作为基本内容的安全核心。
ASP.NET membership uses a provider model for the storage. SqlMembershipProvider inherits encrypting/hashing password functionality from the abstract MembershipProvider class. But you could also inherit from MembershipProvider and get that functionality in a custom provider if you wanted.
If you use the SqlMembershipProvider, you get a fully working membership database with full password management (checking, changing, resetting, invalid password attempts) and user management (CRUD ops, locking out users).
All of that is at an API level. You can create whatever UIs you want against the API.
Using the SqlMembershipProvider doesn't require you to use the Roles Provider or the Profile Provider or any of that other stuff, and you can roll your own for those things without impacting membership. At the very least I would recommend using the well-tested SqlMembershipProvider as the core of your security for the basic stuff.
我已成功实施 DotNetOpenAuth 作为会员和角色提供者。它不是完整的实现，但可以处理最常见的场景。
他们提供 VS 模板来帮助您入门。
I have successfully implemented DotNetOpenAuth as a membership and role provider. It is not a full implementation but handles most common scenarios.
They provide VS templates to get you started.