在 ASP.NET 中模拟会员用户
在启用了会员身份、角色和哈希密码的通用asp.net网站中，我想为管理员提供模拟< /code> 以便他们可以像用户一样浏览网站。该网站应该像该用户登录一样运行，然后能够恢复到他们自己的登录状态。
实现这一目标的最佳方法是什么？
示例用例：具有两种类型用户的网站：“买家”和“管理员”。 该网站提供了一个“购买”按钮来购买管理员专门提供给用户的东西。即只有买家可以使用购买按钮并付款。 用户遇到问题，因此支持管理员可以“模拟”用户的登录并代表他们购买或“查看”他们面临的问题。
如果没有模拟，唯一的方法是在代码中允许这种情况，这就否定了“查看用户问题”的目的。即使我没有使用哈希密码并使用了 FormsAuthentication.SignOut() 并以用户身份手动登录管理员，也不会。
我希望我上面说得有道理。
In a generic asp.net website with Membership, Roles and hashed passwords enabled, I would like to provide the administrators with impersonation so that they may browse the website as that user would. The website should function as if that user is logged on and then be able to revert to their own login.
What is the best approach to achieve this?
An example use-case: A website with two types of users: 'Buyer' and 'Admin'.
The website provides a 'Purchase' button to buy something specifically provided to the user by the admins. i.e only that buyer can use the purchase button and make a payment.
User has trouble so a support admin can 'impersonate' the user's login and purchase on their behalf or 'see' the trouble they are facing.
Without impersonation, the only way is to allow this in code and that negates the purpose of 'seeing the user's issue'. Not even if I was not using hashed passwords and had used FormsAuthentication.SignOut() and manually logged in the admin as the user.
I hope i am making sense above.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
请查看 codeproject.com 上的此示例。我认为它符合您的要求。
Take a look at this sample on codeproject.com. I think it does what you're looking for.
我面前没有用于执行此操作的代码（几年前的作业），但会员 API 中有一些位可以使用代码对某人进行签名。不幸的是，直到这个周末我才能访问代码，或者我可以快速分享这些内容并完成此操作。
我记得您必须首先使用 Membership 类作为 MembershipUser 获取用户。从这一点来看，我不确定您是否必须针对提供程序进行验证或什么。我们确实使用了自定义提供程序，但我忘记了它是否与此解决方案相关。
无论如何，请检查安全位，重点关注membership 和membershipUser。
I don't have the code we used to do this in front of me (assignment from a few years ago), but there are bits in the Membership API to sign someone in using code. I will not have access to the code until this weekend, unfortunately, or I could quickly share the bits and be done with this.
I do remember you had to get the user first, as a MembershipUser, using the Membership class. I am not sure, from this point, whether you had to validate against provider or what.We did use a custom provider, but I forget whether it was related to this solution.
Regardless, examine the security bits, focusing on membership and membershipUser.