不要将密码存储在 .net 成员资格中

Question

我在 MVC 3 .net 应用程序中使用内置的会员系统。在开发的后期，我将使用外部 Web 服务进行身份验证。因此，我只需将（唯一）用户名存储在会员系统中。所有其他用户信息都可以通过网络服务检索。

因此我想知道如何不存储密码？

Answer 1

不用担心密码的存储，创建用户时随机生成并存储密码即可。

让您的帐户控制器在登录方法中针对外部网络服务验证密码，如果密码正确，则只需调用FormsAuthentication.SetAuthCookie(userName, false /*persistantCookie*/)，这将“登录”用户:)

旁注： 如果您只有他们的密码哈希/盐，您是否想过如何将现有用户迁移到新的外部网络服务？

Answer 2

不确定我是否理解正确，但我认为最好的解决方案是编写自定义会员提供程序。基本上，这只是一个类，其中一些功能从基本成员资格提供程序中重写。在这里，您可以实现自己的注册、登录和注销逻辑。

找到了我不久前使用的一个类的示例。只需编写您自己的实现即可。另一种选择是使用您的 accountcontroller（就像 haz 也提到的那样），但我总是倾向于不在我的控制器中实现太多逻辑，而是让我的服务处理业务逻辑。

    public class CustomMembershipProvider : MembershipProvider
    {
        private readonly IGenericService<User> _genericUserService;

        public CustomMembershipProvider(IGenericService<User> genericUserService)
        {
            _genericUserService = genericUserService;
        }

        public CustomMembershipProvider() : this(new GenericService<User>())
        {

        }

        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            throw new NotImplementedException();
        }

        public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer)
        {
            throw new NotImplementedException();
        }

        public override string GetPassword(string username, string answer)
        {
            throw new NotImplementedException();
        }

        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            throw new NotImplementedException();
        }

        public override string ResetPassword(string username, string answer)
        {
            throw new NotImplementedException();
        }

        public override void UpdateUser(MembershipUser user)
        {
            throw new NotImplementedException();
        }

        public override bool ValidateUser(string username, string password)
        {
            try
            {
                var encodedPassword = password.AsSha512();
                var user = _genericUserService.First(u => u.Email == username && u.Password == string.Empty );

                return user != null;
            }
            catch (Exception)
            {
                return false;
            }
        }

        public override bool UnlockUser(string userName)
        {
            throw new NotImplementedException();
        }

        public override MembershipUser GetUser(object providerUserKey, bool userIsOnline)
        {
            throw new NotImplementedException();
        }

        public override MembershipUser GetUser(string username, bool userIsOnline)
        {
            var user = _genericUserService.First(x => x.Email.Equals(username));

            var a = new MembershipUser("", user.Firstname, user.Id, user.Email, "", "", true, user.Active,
                                       user.RegisteredOn, DateTime.Now, DateTime.Now, DateTime.Now, DateTime.Now);

            return a;
        }

        public override string GetUserNameByEmail(string email)
        {
            throw new NotImplementedException();
        }

        public override bool DeleteUser(string username, bool deleteAllRelatedData)
        {
            throw new NotImplementedException();
        }

        public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        public override int GetNumberOfUsersOnline()
        {
            throw new NotImplementedException();
        }

        public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        public override bool EnablePasswordRetrieval
        {
            get { throw new NotImplementedException(); }
        }

        public override bool EnablePasswordReset
        {
            get { throw new NotImplementedException(); }
        }

        public override bool RequiresQuestionAndAnswer
        {
            get { throw new NotImplementedException(); }
        }

        public override string ApplicationName
        {
            get { throw new NotImplementedException(); }
            set { throw new NotImplementedException(); }
        }

        public override int MaxInvalidPasswordAttempts
        {
            get { throw new NotImplementedException(); }
        }

        public override int PasswordAttemptWindow
        {
            get { throw new NotImplementedException(); }
        }

        public override bool RequiresUniqueEmail
        {
            get { throw new NotImplementedException(); }
        }

        public override MembershipPasswordFormat PasswordFormat
        {
            get { throw new NotImplementedException(); }
        }

        public override int MinRequiredPasswordLength
        {
            get { throw new NotImplementedException(); }
        }

        public override int MinRequiredNonAlphanumericCharacters
        {
            get { throw new NotImplementedException(); }
        }

        public override string PasswordStrengthRegularExpression
        {
            get { throw new NotImplementedException(); }
        }
    }