Sitecore - 限制用户拥有的角色
我们将 Sitecore 与我们的 AD 集成。我们的用户有两个级别的访问级别 2 以及需要提升权限的其他所有内容。授予用户的访问级别由两个 cookie 确定。一种是 aspxauto cookie，其有效期为 30 年（级别 2），另一种是在会话结束时到期（其他所有内容都称为级别 4）。 level4 cookie 具有用户所处角色的列表（此列表是用户在 AD 中所处角色列表的子集）。
我需要登录用户并根据可用的 cookie 将其添加到角色。
到目前为止，我已经创建了自己的 ADRoleProvider，它重写了 GetRolesForUser 方法，并且仅返回 cookie 中的角色。但这不起作用，当我直接进入安全页面时，它让我进入（因为用户是 AD 中角色的成员 - 即使 cookie 不存在）。
我无法删除用户所在的所有角色，然后出于明显的原因将用户添加到 cookie 中指定的角色。有没有办法欺骗 Sitecore 认为用户不属于某个角色？
-胜利者
We have sitecore integrated with our AD. Our users have two levels of access level 2 and everything else that needs elevated permissions. The level of access granted to the user is determined by two cookies. One is aspxauto cookie which expires in 30 years (level 2) and the other is to expire at the end of session (everything else aka level4). The level4 cookie has a list of roles the user is in (this list is a subset of the list of roles the user is in within AD).
I need to log in a user and add them to roles based on the cookies that are available.
I have so far created my own ADRoleProvider which overrides the GetRolesForUser method and only returns the roles in the cookies. But this ins't working, when I go directly to a secured page it lets me in (because the user is a memeber of the role in AD - even though the cookies do not exist).
I can't remove all the roles the user is in, in AD then add the user to only the roles specified in the cookie for obvious reasons. Is there a way to trick Sitecore into thinking a user is not in a role?
-Victor
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否尝试重写 IsUserInRole 方法？我认为当 Sitecore 尝试解决访问权限时也会使用它。
Did you try to override IsUserInRole method? I think it is also used when Sitecore tries to resolve access rights.