ASP.NET 授权属性和管理员用户角色

发布于 2024-11-29 09:49:35 字数 633 浏览 1 评论 0原文

使用Authorize属性我可以指定允许访问资源的角色。

[Authorize(Roles="User")]

但是，如果我有允许访问任何资源的管理员用户，我也需要指定这个资源，

[Authorize(Roles="User, Administrator")]

但可能有某种方式我可以说管理员允许去任何地方而不是在授权属性中指定这个资源？

所以我的意思是，如果代码中的某个位置（在控制器上或在操作上）是这个 [Authorize(Roles="User")] 这意味着管理员角色允许去那里以及。

或者我可以将其设置为所有动态授权角色，当应用程序启动时如何？

有什么想法吗？

更新：

目前我有一个具有授权属性 [Authorize(Role="Administrator")] 的管理控制器，并且我在另一个具有属性 [Authorize(Role="User") 的控制器中执行了一些操作)] 所以如果我没有找到更好的解决方案，我还需要添加 "Administrator" 。

原文

Using Authorize attribute i may specify roles which is allowed to access the resources.

[Authorize(Roles="User")]

But if i have admin user which is allowed to go to any resource i need specify this one as well

[Authorize(Roles="User, Administrator")]

But may be there is some way i can say somehow that Administrator allowed to go anywhere and not to specify this one in Authorize attribute?

So i mean if somewhere in code(on controller or on action) would be this [Authorize(Roles="User")] it means that Administrator role allowed to go there as well.

Or may be i may set it to all Authorize roles dynamically how when application start?

Any ideas?

UPDATED:

Currently i have one admin controller with Authorize attribute [Authorize(Role="Administrator")] and i have some actions in some another controllers with attributes [Authorize(Role="User")] so i will need to add "Administrator" there as well if i didn't find better solution.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

双马尾 2024-12-06 09:49:35

我认为这对你有用。使用 AuthorizeAttribute 创建您自己的基控制器，然后使其他控制器继承您的基类。

[Authorize(Roles="Admin")]
public class MyFancyController : Controller
{
}

[Authorize(Roles = "TaxPayer")]
public class WizardController : MyFancyController
{
...

在我看来，这很可怕。

您有多少个控制器/操作？如果您稍后忘记了这一点并且您可能不希望管理员访问某个页面怎么办？

调试代码会变得更加困难吗？

I think this will work for you. Create your own base controller, with the AuthorizeAttribute, then make your other Controllers inherit your base class.

[Authorize(Roles="Admin")]
public class MyFancyController : Controller
{
}

[Authorize(Roles = "TaxPayer")]
public class WizardController : MyFancyController
{
...

This is scary though, in my opinion.

How many controllers/Actions do you have? What if you forget about this later and maybe you have a page you don't want Admins to access?

Will debugging the code become more difficult?

回复收藏 0 原文

禾厶谷欠 2024-12-06 09:49:35

[Authorize(Roles = "User, Admin")]
public class PrestamosController : Controller
{
    // controller details
}

[Authorize(Roles = "User, Admin")]
public class PrestamosController : Controller
{
    // controller details
}

回复收藏 0 原文

深居我梦 2024-12-06 09:49:35

您可以创建自定义过滤器并使用它来装饰您的操作或控制器。
这是一个我经常使用的简单结构：

public class AuthorizationAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
            filterContext.Result = new HttpUnauthorizedResult();
            return;
        }

        var actionName = filterContext.ActionDescriptor.ActionName; 
        var controllerName = filterContext.Controller.GetType().Name;

        bool isAuthorized =false;

        // Put your logic here !!!!

        if (!isAuthorized)  {
            filterContext.Result = new HttpUnauthorizedResult();        
            return;
        }
    }
}

您可以阅读更多内容此处

You can create a custom filter and use it to decorate your Actions or Controllers with it.
This is a simple structure I've used quite a lot:

public class AuthorizationAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
            filterContext.Result = new HttpUnauthorizedResult();
            return;
        }

        var actionName = filterContext.ActionDescriptor.ActionName; 
        var controllerName = filterContext.Controller.GetType().Name;

        bool isAuthorized =false;

        // Put your logic here !!!!

        if (!isAuthorized)  {
            filterContext.Result = new HttpUnauthorizedResult();        
            return;
        }
    }
}

You can read some more here

回复收藏 0 原文