通过本地 Windows 组进行 WCF RIA 授权
我目前正在为我的公司开发基于 WFC RIA 的 Silverlight 业务应用程序（仅限 Intranet 使用）。我在尝试授权用户时遇到了一些问题。情况如下：
该应用程序在我们的 Windows 域中运行，因此使用 Windows 身份验证，该身份验证已经运行良好。对某些域服务操作的访问应仅限于某个组的成员（假设为“管理员”）。该组在托管应用程序的服务器上本地可用，并且已用于限制对 SQL Server 实例的访问。无法将此组添加到域并使其全局可用。
我知道我可以通过 RequiresRole[] 属性限制对域服务方法的访问。但问题是，用户的本地组成员身份未加载到可通过 WebContext.Current.User 获取的用户对象中，因此授权失败。
有没有解决方法或更好的方法来做到这一点？
提前致谢！
I'm currently developing a WFC RIA based Silverlight Business Application (intranet use only) for my company. I ran into a couple of problems when trying to authorize users. Here is the situation:
The app is running in our Windows domain and is therefore using Windows Authentication, which already works well. Access to certain domain service operations shall be restricted to members of a certain group (let's say "Admins"). This group is available locally on the server where the app is hosted and is already used to restrict access to the SQL Server instance. It will not be possible to add this group to the domain and make it available globally.
I know that I can restrict access to domain service methods via the RequiresRole[] attribute. The problem is, however, that the local group memberships of a user are not loaded into the user object that is available via WebContext.Current.User and therefore the authorization fails.
Is there any workaround or better way to do this?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您是否尝试过在要限制的服务方法上设置“PrincipalPermission”属性？
此致，
阿尔詹
Have you tried setting the "PrincipalPermission" attribute on the service method you want to restrict?
Best regards,
Arjen
我解决了我的问题。
我所做的是将 AspnetDb 数据库复制到我的服务器计算机上的 SQL Server 实例。该数据库保存有关用户、角色等的所有信息，并由 ASP.NET 角色管理器用于授权目的。该数据库通常位于 Web 项目的项目文件夹中（App_Data 目录内）。要使新配置生效，您必须更改 Web.config 中的连接字符串
（有关更多详细信息：http://weblogs.asp.net/ scottgu/archive/2005/08/25/423703.aspx）。
我手动将新用户添加到数据库中。您在此处输入的用户名必须与 Windows 用户名匹配（例如 DOMAIN\USER_NAME）。然后，您可以向数据库添加新角色，并为所有用户分配特定角色。
ASP.NET 角色管理器在应用程序启动时自动加载角色/用户，您可以通过
RequiresRole[]属性限制对域服务方法的访问。另外，还有一种方法可以根据角色成员身份动态显示/隐藏/启用/禁用用户控件，请参见此处：http://blogs.msdn.com/b/kylemc/archive/2010/05/04/authorization-sample-201.aspx
I solved my issue.
What I did was to copy the AspnetDb database to the SQL Server instance on my server machine. This database is holding all the information about users, roles, etc and is used by the ASP.NET role manager for authorization purposes. This database is usually located in the project folder of your Web project (inside the App_Data directory). To make the new configuration work, you have to change the connection string inside your Web.config
(for more details: http://weblogs.asp.net/scottgu/archive/2005/08/25/423703.aspx).
I manually added new users to the database. The user name you enter there must match the Windows user name (eg. DOMAIN\USER_NAME). Then you can add new roles to the database and give all your users their specific roles.
The ASP.NET role manager automatically loads the roles/users on application startup and you can restrict access to your domain service methods via the
RequiresRole[]attribute.In addition, there is also a way to dynamically show/hide/enable/disable user controls based on role membership, see here: http://blogs.msdn.com/b/kylemc/archive/2010/05/04/authorization-sample-201.aspx