ASP.NET MVC - 角色提供程序的替代方案？

Question

我试图避免使用角色提供程序和成员资格提供程序，因为在我看来它太笨拙了，因此我试图制作自己的“版本”，它不那么笨拙并且更易于管理/灵活。现在我的问题是……除了角色提供者之外，还有其他不错的选择吗？ （我知道我可以自定义角色提供者、成员资格提供者等）

通过更易于管理/灵活，我的意思是我仅限于使用角色静态类，而不是直接实现到与数据库上下文交互的服务层中我必须使用 Roles 静态类，它有自己的数据库上下文等，表名也很糟糕..

提前致谢。

Answer 1

我和你的情况一样——我一直讨厌 RoleProviders。是的，如果您想启动并运行一个小型网站，它们非常棒，但它们不太现实。我一直发现的主要缺点是它们将您直接与 ASP.NET 联系在一起。

我最近的一个项目的方式是定义几个作为服务层一部分的接口（注意：我简化了这些接口 - 但您可以轻松添加到它们）：

public interface IAuthenticationService
{
    bool Login(string username, string password);
    void Logout(User user);
}

public interface IAuthorizationService
{
    bool Authorize(User user, Roles requiredRoles);
}

然后您的用户可以拥有一个角色 枚举：

public enum Roles
{
    Accounting = 1,
    Scheduling = 2,
    Prescriptions = 4
    // What ever else you need to define here.
    // Notice all powers of 2 so we can OR them to combine role permissions.
}

public class User
{
    bool IsAdministrator { get; set; }
    Roles Permissions { get; set; }
}

对于您的 IAuthenticationService，您可以有一个执行标准密码检查的基本实现，然后您可以有一个 FormsAuthenticationService 执行更多操作，例如设置 cookie 等。对于您的 AuthorizationService，您需要这样的东西：

public class AuthorizationService : IAuthorizationService
{
    public bool Authorize(User userSession, Roles requiredRoles)
    {
        if (userSession.IsAdministrator)
        {
            return true;
        }
        else
        {
            // Check if the roles enum has the specific role bit set.
            return (requiredRoles & user.Roles) == requiredRoles;
        }
    }
}

在这些基本服务之上，您可以轻松添加服务来重置密码等。

由于您使用的是 MVC，您可以使用 ActionFilter 在操作级别进行授权：

public class RequirePermissionFilter : IAuthorizationFilter
{
    private readonly IAuthorizationService authorizationService;
    private readonly Roles permissions;

    public RequirePermissionFilter(IAuthorizationService authorizationService, Roles requiredRoles)
    {
        this.authorizationService = authorizationService;
        this.permissions = requiredRoles;
        this.isAdministrator = isAdministrator;
    }

    private IAuthorizationService CreateAuthorizationService(HttpContextBase httpContext)
    {
        return this.authorizationService ?? new FormsAuthorizationService(httpContext);
    }

    public void OnAuthorization(AuthorizationContext filterContext)
    {
        var authSvc = this.CreateAuthorizationService(filterContext.HttpContext);
        // Get the current user... you could store in session or the HttpContext if you want too. It would be set inside the FormsAuthenticationService.
        var userSession = (User)filterContext.HttpContext.Session["CurrentUser"];

        var success = authSvc.Authorize(userSession, this.permissions);

        if (success)
        {
            // Since authorization is performed at the action level, the authorization code runs
            // after the output caching module. In the worst case this could allow an authorized user
            // to cause the page to be cached, then an unauthorized user would later be served the
            // cached page. We work around this by telling proxies not to cache the sensitive page,
            // then we hook our custom authorization code into the caching mechanism so that we have
            // the final say on whether or not a page should be served from the cache.
            var cache = filterContext.HttpContext.Response.Cache;
            cache.SetProxyMaxAge(new TimeSpan(0));
            cache.AddValidationCallback((HttpContext context, object data, ref HttpValidationStatus validationStatus) =>
            {
                validationStatus = this.OnCacheAuthorization(new HttpContextWrapper(context));
            }, null);
        }
        else
        {
            this.HandleUnauthorizedRequest(filterContext);
        }
    }

    private void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        // Ajax requests will return status code 500 because we don't want to return the result of the
        // redirect to the login page.
        if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
        {
            filterContext.Result = new HttpStatusCodeResult(500);
        }
        else
        {
            filterContext.Result = new HttpUnauthorizedResult();
        }
    }

    public HttpValidationStatus OnCacheAuthorization(HttpContextBase httpContext)
    {
        var authSvc = this.CreateAuthorizationService(httpContext);
        var userSession = (User)httpContext.Session["CurrentUser"];

        var success = authSvc.Authorize(userSession, this.permissions);

        if (success)
        {
            return HttpValidationStatus.Valid;
        }
        else
        {
            return HttpValidationStatus.IgnoreThisRequest;
        }
    }
}

然后您可以在控制器操作上进行装饰：

[RequirePermission(Roles.Accounting)]
public ViewResult Index()
{
   // ...
}

这种方法的优点是您还可以使用依赖项注入和 IoC 容器来连接事物。此外，您还可以在多个应用程序（不仅仅是 ASP.NET 应用程序）中使用它。您将使用 ORM 来定义适当的模式。

如果您需要有关 FormsAuthorization/Authentication 服务的更多详细信息或从这里开始，请告诉我。

编辑：要添加“安全修剪”，您可以使用 HtmlHelper 来完成。这可能需要更多……但你明白了。

public static bool SecurityTrim<TModel>(this HtmlHelper<TModel> source, Roles requiredRoles)
{
    var authorizationService = new FormsAuthorizationService();
    var user = (User)HttpContext.Current.Session["CurrentUser"];
    return authorizationService.Authorize(user, requiredRoles);
}

然后在您的视图中（此处使用 Razor 语法）：

@if(Html.SecurityTrim(Roles.Accounting))
{
    <span>Only for accounting</span>
}

编辑：UserSession 看起来像这样：

public class UserSession
{
    public int UserId { get; set; }
    public string UserName { get; set; }
    public bool IsAdministrator { get; set; }
    public Roles GetRoles()
    {
         // make the call to the database or whatever here.
         // or just turn this into a property.
    }
}

这样，我们就不会公开当前会话中的密码哈希和所有其他详细信息用户，因为用户的会话生命周期确实不需要它们。

Answer 2

我已经实现了一个基于@TheCloudlessSky 帖子的角色提供者。我认为我可以添加和分享我所做的一些事情。
首先，如果您想将 RequirepPermission 类用作操作过滤器的属性，则需要为 RequirepPermission 类实现 ActionFilterAttribute 类。

接口类 IAuthenticationService 和 IAuthorizationService

public interface IAuthenticationService
{
    void SignIn(string userName, bool createPersistentCookie);
    void SignOut();
}

public interface IAuthorizationService
{
    bool Authorize(UserSession user, string[] requiredRoles);
}

FormsAuthenticationService 类

/// <summary>
/// This class is for Form Authentication
/// </summary>
public class FormsAuthenticationService : IAuthenticationService
{

    public void SignIn(string userName, bool createPersistentCookie)
    {
        if (String.IsNullOrEmpty(userName)) throw new ArgumentException(@"Value cannot be null or empty.", "userName");

        FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
    }

    public void SignOut()
    {
        FormsAuthentication.SignOut();
    }
}

UserSession calss

public class UserSession
{
    public string UserName { get; set; }
    public IEnumerable<string> UserRoles { get; set; }
}

还有一点是 FormsAuthorizationService 类和我们如何将用户分配给 httpContext.Session["CurrentUser"]。在这种情况下，我的方法是创建 userSession 类的新实例，并将用户从 httpContext.User.Identity.Name 直接分配给 userSession 变量，如您在 FormsAuthorizationService 中看到的那样> 类。

[AttributeUsageAttribute(AttributeTargets.Class | AttributeTargets.Struct | AttributeTargets.Constructor | AttributeTargets.Method, Inherited = false)]
public class RequirePermissionAttribute : ActionFilterAttribute, IAuthorizationFilter
{
    #region Fields

    private readonly IAuthorizationService _authorizationService;
    private readonly string[] _permissions;

    #endregion

    #region Constructors

    public RequirePermissionAttribute(string requiredRoles)
    {
        _permissions = requiredRoles.Trim().Split(',').ToArray();
        _authorizationService = null;
    }

    #endregion

    #region Methods

    private IAuthorizationService CreateAuthorizationService(HttpContextBase httpContext)
    {
        return _authorizationService ?? new FormsAuthorizationService(httpContext);
    }

    public void OnAuthorization(AuthorizationContext filterContext)
    {
        var authSvc = CreateAuthorizationService(filterContext.HttpContext);
        // Get the current user... you could store in session or the HttpContext if you want too. It would be set inside the FormsAuthenticationService.
        if (filterContext.HttpContext.Session == null) return;
        if (filterContext.HttpContext.Request == null) return;
        var success = false;
        if (filterContext.HttpContext.Session["__Roles"] != null)
        {
            var rolesSession = filterContext.HttpContext.Session["__Roles"];
            var roles = rolesSession.ToString().Trim().Split(',').ToList();
            var userSession = new UserSession
            {
                UserName = filterContext.HttpContext.User.Identity.Name,
                UserRoles = roles
            };
            success = authSvc.Authorize(userSession, _permissions);
        }
        if (success)
            {
                // Since authorization is performed at the action level, the authorization code runs
                // after the output caching module. In the worst case this could allow an authorized user
                // to cause the page to be cached, then an unauthorized user would later be served the
                // cached page. We work around this by telling proxies not to cache the sensitive page,
                // then we hook our custom authorization code into the caching mechanism so that we have
                // the final say on whether or not a page should be served from the cache.
                var cache = filterContext.HttpContext.Response.Cache;
                cache.SetProxyMaxAge(new TimeSpan(0));
                cache.AddValidationCallback((HttpContext context, object data, ref HttpValidationStatus validationStatus) =>
                                                {
                                                    validationStatus = OnCacheAuthorization(new HttpContextWrapper(context));
                                                }, null);
            }
            else
            {
                HandleUnauthorizedRequest(filterContext);
            }
    }

    private static void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        // Ajax requests will return status code 500 because we don't want to return the result of the
        // redirect to the login page.
        if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
        {
            filterContext.Result = new HttpStatusCodeResult(500);
        }
        else
        {
            filterContext.Result = new HttpUnauthorizedResult();
        }
    }

    private HttpValidationStatus OnCacheAuthorization(HttpContextBase httpContext)
    {
        var authSvc = CreateAuthorizationService(httpContext);
        if (httpContext.Session != null)
        {
            var success = false;
            if (httpContext.Session["__Roles"] != null)
            {
                var rolesSession = httpContext.Session["__Roles"];
                var roles = rolesSession.ToString().Trim().Split(',').ToList();
                var userSession = new UserSession
                {
                    UserName = httpContext.User.Identity.Name,
                    UserRoles = roles
                };
                success = authSvc.Authorize(userSession, _permissions);
            }
            return success ? HttpValidationStatus.Valid : HttpValidationStatus.IgnoreThisRequest;
        }
        return 0;
    }

    #endregion
}

internal class FormsAuthorizationService : IAuthorizationService
{
    private readonly HttpContextBase _httpContext;

    public FormsAuthorizationService(HttpContextBase httpContext)
    {
        _httpContext = httpContext;
    }

    public bool Authorize(UserSession userSession, string[] requiredRoles)
    {
        return userSession.UserRoles.Any(role => requiredRoles.Any(item => item == role));
    }
}

然后在您的控制器中，用户通过身份验证后，您可以从数据库获取角色并将其分配给角色会话：

var roles = Repository.GetRolesByUserId(Id);
if (ControllerContext.HttpContext.Session != null)
   ControllerContext.HttpContext.Session.Add("__Roles",roles);
FormsService.SignIn(collection.Name, true);

用户从系统注销后，您可以清除会话

FormsService.SignOut();
Session.Abandon();
return RedirectToAction("Index", "Account");

该模型中的警告是，当用户登录系统后，如果为用户分配了角色，则授权不起作用，除非他注销并重新登录系统。

另一件事是，不需要为角色创建单独的类，因为我们可以直接从数据库获取角色并将其设置到控制器中的角色会话中。

完成所有这些代码的实现后，最后一步是将此属性绑定到控制器中的方法：

[RequirePermission("Admin,DM")]
public ActionResult Create()
{
return View();
}

Answer 3

如果您使用 Castle Windsor 依赖注入，您可以注入 RoleProvider 列表，这些列表可用于从您选择实现的任何源确定用户权限。

http://ivida.co.uk/2011/05/18/mvc-getting-user-roles-from-multiple-sources-register-and-resolve-arrays- of-dependencis-using-the- Fluent-api/

Answer 4

您不需要为角色使用静态类。例如， SqlRoleProvider 允许您定义数据库中的角色。

当然，如果您想从自己的服务层检索角色，那么创建自己的角色提供程序并不难 - 实际上没有那么多方法可以实现。

Answer 5

您可以实施自己的会员和角色 通过覆盖适当的接口来提供者。

如果您想从头开始，通常这些类型的东西是作为 自定义 http 实现的module 将用户凭据存储在 httpcontext 或会话中。无论哪种方式，您可能都希望使用某种身份验证令牌来设置 cookie。