我需要为我的朋友构建一个“我的帐户”应用程序。我计划使用 asp.net MVC 3。
我必须使用第三方 API 来验证用户身份。如果这是常规的 Web 应用程序，这很简单，我使用第三方 API 提交请求，获取响应。如果这是授权用户，则创建一个会话。在所有受保护的页面上，我只是检查会话，如果存在，则显示内容，否则重定向回登录页面。
我可能可以在我的 mvc3 项目上做同样的事情，但我知道这绝对是一个错误的方法。 MVC3非常灵活。一定有更好的方法来做到这一点。当我从第三方 API 收到响应后。之后我应该做什么？如果可以的话请给我一些代码。
I need to build a "my account" application for my friend. I plan to use asp.net MVC 3.
I have to use third party API to authenticate users. if this is regular web application, it is easy, I submit the request using third party API, get response back. if this is authorized user, create a session. ON all the protected pages, i just check the session, if it is exist, then show the content, otherwise redirect back to login page.
I probably can do the same on my mvc3 project, but I know that definitely is a wrong approach. MVC3 is very flexiable. there must be a better way to do it. After I get response back from the third party API. What should I do after that? please show me some codes if you can.
发布评论
评论（4）
使用 ASP.NET 成员资格提供程序并创建自定义提供程序以挂钩到您的 API。这会为你完成很多艰苦的工作，而且你不会“重新发明轮子”。这里有关于如何使用 MVC 执行此操作的精彩概述：http://theintegrity.co.uk/2010/11/asp-net-mvc-2-custom-membership-provider-tutorial-part-1/
Use the ASP.NET membership provider and create a custom provider to hook into your API. This gets a lot of the hard work done for you and you're not "reinventing the wheel". There's a great overview about how to do this with MVC here: http://theintegrity.co.uk/2010/11/asp-net-mvc-2-custom-membership-provider-tutorial-part-1/
[Authorize(Roles="Administrators")] public class MyAdminOnlyController : Controller { }完毕！
[Authorize(Roles="Administrators")] public class MyAdminOnlyController : Controller { }Done!
我不认为使用 MVC3 进行身份验证与常规 Web 应用程序有什么不同。在您的控制器中，您将从视图获取的用户名和密码发送到 API，并获取响应。
然后，您可以将其保存到会话中，并在您想要保护的任何页面上进行检查。
MVC正是分离视图逻辑、业务逻辑和数据模型的方式。申请流程相同。
I don't think using MVC3 for authentication is anything different than regular web app. In your controller, you will send the username and password getting from the view to the API,getting the response back.
You can then save it to session and check against it on any page you want to be protected.
MVC is just the way to separate view logic, business logic and data model. The application flow is the same.
ASP.NET 已经构建了 ASP.NET 会员提供程序。后端数据可以存储在 ASP.NET 配置网站、SQL Server 数据库、Active Directory 和其他数据库中，但您需要自定义身份验证提供程序。
这是 SQLServer 会员资格提供程序的示例，有关详细文档，您可以阅读 此处
对于 ASP.NET 配置管理成员资格提供程序，您可以从 音乐商店 ASP.NET MVC 教程 in 会员和授权部分。如果您想了解 ASP.NET MVC 身份验证/授权。音乐商店示例是探索 ASP.NET MVC3 功能、实体框架和身份验证的推荐教程。
ASP.NET already build ASP.NET membership provider. The back end data can be stored in ASP.NET Configuration website, SQL Server database,Active Directory, and another database but you need to custom the authentication provider.
this is the expample for SQLServer Membership provider, for the detail documentation you can read from here
For ASP.NET Configuration management Membership provider, you can read from Music Store ASP.NET MVC tutorial in Membership and Authorization section. If you want to learn about ASP.NET MVC authentication/authorization. Music Store example is a recommended tutorial for exploring ASP.NET MVC3 feature, Entity Framework and Authentication also.