c# - Asp.net Identity 2.0 自定义登录方法

Question

我正在使用 Identity 2.0 开发 ASP.NET 5 应用程序。我有两种类型的用户:

1. 正常 - 他们使用标准登录方法进行身份验证。
2. 临时 - 他们应该根据提供的 token 登录。

我不想存储临时用户，除了验证用户所需的信息(一些用户名和 token )。如果用户提供用户名和有效密码，他应该登录。

我不确定如何实现这一目标。

Answer 1

您也可以同时在这两种情况下使用 Identity。对于第一种情况，使用 Identity 就像您之前所做的一样，没有任何更改，但对于第二种情况，您在登录方法中稍作修改。

public ActionResoult TempLogin(string username, string password)
{
    // imaging you have own temp user manager, completely independent from identity
    if(_tempUserManager.IsValid(username,password))         
    {
        // user is valid, going to authenticate user for my App
        var ident = new ClaimsIdentity(
        new[] 
        {
            // adding following 2 claim just for supporting default antiforgery provider
            new Claim(ClaimTypes.NameIdentifier, username),
            new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity", "http://www.w3.org/2001/XMLSchema#string"),

            // an optional claim you could omit this 
            new Claim(ClaimTypes.Name, username),

            // you could even add some role
            new Claim(ClaimTypes.Role, "TempUser"),
            new Claim(ClaimTypes.Role, "AnotherRole"),
            // and so on
        },
        DefaultAuthenticationTypes.ApplicationCookie);

        // Identity is sign in user based on claim don't matter 
        // how you generated it Identity 
        HttpContext.GetOwinContext().Authentication.SignIn(
            new AuthenticationProperties { IsPersistent = false }, ident);

        // auth is succeed, 
        return RedirectToAction("MyAction"); 
     }
     ModelState.AddModelError("", "We could not authorize you :(");
     return View();
}

由于我们将我们的逻辑注入(inject)到 Identity 中，所以我们根本不需要做额外的事情。

[Authorize]
public ActionResult MySecretAction()
{
    // all authorized users could use this method don't matter how has been authenticated
    // we have access current user principal by calling also
    // HttpContext.User
}

[Authorize(Roles="TempUser")]
public ActionResult MySecretAction()
{
    // just temp users have accesses to this method
}