使用角色授权属性

Question

我想实现我的自定义授权，我想知道我的代码有什么问题，即使我正确获取了用户凭据，它仍然会将我重定向到我的登录方法，请参阅下面的代码

编辑：我已经成功实现了带角色的授权属性，未来的读者请看下面的代码

登录控制器

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult Login (AdminViewModels.Login viewModel, string returnURL)
{
    if (!ModelState.IsValid)
    {
        return View(viewModel);
    }
    PasswordHasher passwordVerify = new PasswordHasher();
    var query = (from acc in db.accounts.Where(x => x.username == viewModel.Username)
                select new { acc.username, acc.password}).FirstOrDefault();
    if (query != null)
    {
        if (ModelState.IsValid)
        {
            var result = passwordVerify.VerifyHashedPassword(query.password, viewModel.Password);
            switch (result)
            {
                case PasswordVerificationResult.Success:
//set forms ticket to be use in global.asax
                    SetupFormsAuthTicket(viewModel.Username, viewModel.rememeberMe);
                    return RedirectToLocal(returnURL);
                case PasswordVerificationResult.Failed:
                    ModelState.AddModelError("", "Wrong Username or Password");
                    return View(viewModel);
            }
        }
    }
    return View(viewModel);
}

表单验证票

private account SetupFormsAuthTicket(string userName, bool persistanceFlag)
{
    account user = new account();
    var userId = user.id;
    var userData = userId.ToString(CultureInfo.InvariantCulture);
    var authTicket = new FormsAuthenticationTicket(1, //version
                        userName, // user name
                        DateTime.Now,             //creation
                        DateTime.Now.AddMinutes(20), //Expiration
                        persistanceFlag, //Persistent
                        userData);

    var encTicket = FormsAuthentication.Encrypt(authTicket);
    Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
    return user;
}

全球.asax

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        if (FormsAuthentication.CookiesSupported == true)
        {
            if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
            {
                try
                {
                    //take out user name from cookies              
                    string username = FormsAuthentication.Decrypt(Request.Cookies[FormsAuthentication.FormsCookieName].Value).Name;
                    string[] roles = null;

                    trainingEntities db = new trainingEntities();
                    //query database to get user roles
                    var query = (from acc in db.account_roles where acc.account.username == username select acc.role.role_name).ToArray();
                    roles = query;

                    //Let us set the Pricipal with our user specific details
                    HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(
                      new System.Security.Principal.GenericIdentity(username, "Forms"), roles);
                }
                catch (Exception)
                {
                    //somehting went wrong
                }
            }
        }
    } 

现在你可以使用[Authorize(Roles = "Admin")]

到任何操作方法或在控制器之上

Answer 1

我已经成功实现了带角色的授权属性，未来的读者请看下面的代码。

登录控制器

            [HttpPost]
            [AllowAnonymous]
            [ValidateAntiForgeryToken]
            public ActionResult Login (AdminViewModels.Login viewModel, string returnURL)
            {
                if (!ModelState.IsValid)
                {
                    return View(viewModel);
                }
                PasswordHasher passwordVerify = new PasswordHasher();
                var query = (from acc in db.accounts.Where(x => x.username == viewModel.Username)
                            select new { acc.username, acc.password}).FirstOrDefault();
                if (query != null)
                {
                    if (ModelState.IsValid)
                    {
                        var result = passwordVerify.VerifyHashedPassword(query.password, viewModel.Password);
                        switch (result)
                        {
                            case PasswordVerificationResult.Success:
                               //set forms ticket to be use in global.asax
                                SetupFormsAuthTicket(viewModel.Username, viewModel.rememeberMe);
                                return RedirectToLocal(returnURL);
                            case PasswordVerificationResult.Failed:
                                ModelState.AddModelError("", "Wrong Username or Password");
                                return View(viewModel);

                        }
                    }
                }
                return View(viewModel);

            }

FormsAuthTicket

  private account SetupFormsAuthTicket(string userName, bool persistanceFlag)
    {
        account user = new account();
        var userId = user.id;
        var userData = userId.ToString(CultureInfo.InvariantCulture);
        var authTicket = new FormsAuthenticationTicket(1, //version
                            userName, // user name
                            DateTime.Now,             //creation
                            DateTime.Now.AddMinutes(20), //Expiration
                            persistanceFlag, //Persistent
                            userData);

        var encTicket = FormsAuthentication.Encrypt(authTicket);
        Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
        return user;
    }

全球.asax

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        if (FormsAuthentication.CookiesSupported == true)
        {
            if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
            {
                try
                {
                    //take out user name from cookies              
                    string username = FormsAuthentication.Decrypt(Request.Cookies[FormsAuthentication.FormsCookieName].Value).Name;
                    string[] roles = null;

                    trainingEntities db = new trainingEntities();
                    //query database to get user roles
                    var query = (from acc in db.account_roles where acc.account.username == username select acc.role.role_name).ToArray();
                    roles = query;

                    //Let us set the Pricipal with our user specific details
                    HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(
                      new System.Security.Principal.GenericIdentity(username, "Forms"), roles);
                }
                catch (Exception)
                {
                    //somehting went wrong
                }
            }
        }
    } 

现在你可以使用[Authorize(Roles = "Admin")]

到任何操作方法或在控制器之上

Answer 2

正如我在 ControllerLogin 属性中看到的，它现在被应用到变量中，当它应该被应用到方法或类时

 [CustomAuthorization(UserRole="Admin")]
 // GET: Manage
 private trainingEntities db = new trainingEntities();
 public ActionResult Index()
 {
     return View();
 }


Private trainingEntities dB = new TrainingEntities();

[CustomAuthorization(UserRole="Admin")]
Public ActionResult Index()
{
   //yourcode
}