MVC 中的自定义表单身份验证
我想在我的网站上使用身份验证才能登录管理部分。我已经有了数据库架构，我不想使用 SQL Server 的 ASP.NET 成员资格表。我有三个表：Employees、Roles 和EmployeesInRoles。
我真的很想让这尽可能简单，但我很难找到解决方案。我只想对我的表使用表单身份验证，以便员工可以登录、注销、更改密码等。
如果有人可以指导我阅读有关此内容的博客文章或教程，那就太好了。
I want to use authentication on my site in order to login to the Admin section. I already have my database schema, I don't want to use the ASP.NET membership tables for SQL Server. I have three tables: Employees, Roles, and EmployeesInRoles.
I'd really like to keep this as simple as possible, but I'm having trouble finding a solution. I just want to use forms authentication with my tables so employees can log in, log out, change their password, etc.
If anyone could direct me to a blog post or tutorial about this, that would be great.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
史蒂文，查看我关于网站安全的系列教程：http://www.asp.net/web-forms/overview/older-versions-security/introduction/security-basics-and-asp-net-support-cs
（编辑：我已经更新了上面的 URL，因为原始 URL 返回了 404。但请记住，本材料是 2008 年编写的，现在已经过时了。）
前三个教程专门关注基于表单的内容无需讨论成员资格即可进行身份验证。前三个教程 - 特别是教程 #2 和 #3 - 应该会让您朝着正确的方向前进。
要在不使用内置 ASP.NET 角色框架的情况下实现角色，请查看本文：基于角色的表单身份验证。
话虽如此，我建议您重新考虑使用 ASP.NET 内置的成员资格和角色库。避免它们意味着您将不得不重新发明轮子，而且您可能会做错。 （例如，您是否在自定义实现中安全地存储用户密码？）
祝您编程愉快！
Steven, check out my series of tutorials on website security: http://www.asp.net/web-forms/overview/older-versions-security/introduction/security-basics-and-asp-net-support-cs
(EDIT: I've updated the above URL as the original URL was returning a 404. But please bear in mind that this material was written in 2008 and is hopelessly dated now.)
The first three tutorials focus exclusively on forms-based authentication without discussing Membership. These first three tutorials - especially tutorials #2 and #3 - should get you moving in the right direction.
To implement roles without using the built-in ASP.NET Roles framework, check out this article: Role-Based Authorization With Forms Authentication.
All that being said, I would suggest that you reconsider using ASP.NET's baked in Membership and Roles libraries. Avoiding them means you're going to have to reinvent the wheel, and you'll probably do it wrong. (For instance, are you securely storing user passwords in your custom implementation?)
Happy Programming!
内置的成员资格提供程序基于接口，可以将其实现替换为您自己的实现，其中（除其他外）可以使用您自己的表进行身份验证。
以下是有关创建自定义 ASP.NET 会员资格提供程序的视频：
http://www.asp.net /general/videos/how-do-i-create-a-custom-membership-provider
这是一篇很好的一般性文章，其中包含指向其他资源的指针：
http://weblogs.asp.net/scottgu/archive/2006/02/24/ASP.NET-2.0-Membership_2C00_-Roles_2C00_-Forms-Authentication_2C00_-and-Security-Resources-.aspx
The built-in Membership provider is based on interfaces that can have their implementation replaced by your own, which (among other things) can use your own tables for authentication.
Here is a video on creating a custom ASP.NET Membership provider:
http://www.asp.net/general/videos/how-do-i-create-a-custom-membership-provider
Here's a good general article with pointers to other resources:
http://weblogs.asp.net/scottgu/archive/2006/02/24/ASP.NET-2.0-Membership_2C00_-Roles_2C00_-Forms-Authentication_2C00_-and-Security-Resources-.aspx