asp.net - 用户处于角色 "admin"但 [Authorize(Roles ="admin")] 不会进行身份验证

Question

我在描述 how to set up custom user roles 上找到了一个很好的答案，我在我的项目中也做了同样的事情。所以在我的登录服务中我有:

public ActionResult Login() {
  // password authentication stuff omitted here
  var roles = GetRoles(user.Type); // returns a string e.g. "admin,user"
  var authTicket = new FormsAuthenticationTicket(
                    1,
                    userName,
                    DateTime.Now,
                    DateTime.Now.AddMinutes(20), // expiry
                    false,
                    roles,
                    "/");
  var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, 
    FormsAuthentication.Encrypt(authTicket));
  Response.Cookies.Add(cookie);
  return new XmlResult(xmlDoc); // don't worry so much about this - returns XML as ActionResult
}

在 Global.asax.cs 中，我(从其他答案中逐字复制):

protected void Application_AuthenticateRequest(Object sender, EventArgs e) {
  var authCookie = Context.Request.Cookies[FormsAuthentication.FormsCookieName];
  if (authCookie != null) {
    var authTicket = FormsAuthentication.Decrypt(authCookie.Value);
    var roles = authTicket.UserData.Split(new Char[] { ',' });
    var userPrincipal = new GenericPrincipal(new GenericIdentity(authTicket.Name), roles);
    Context.User = userPrincipal;
  }
}

然后，在我的 ServicesController 类中，我有:

[Authorize(Roles = "admin")]
//[Authorize]
public ActionResult DoAdminStuff() {
  ...
}

我以具有“admin”角色的用户身份登录，这很有效。然后我调用/services/doadminstuff - 并且访问被拒绝，即使当我在 Global.asax.cs 中放置断点时，我可以看到我的角色确实包含“admin”。如果我注释掉第一个 Authorize 属性(带有角色)并仅使用普通的 Authorize，那么我就可以访问该服务。

我一定在这里遗漏了一些关键的东西 - 但从哪里开始寻找呢？

Answer 1

我建议您使用自定义授权属性而不是 Application_AuthenticateRequest:

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = true)]
public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        string cookieName = FormsAuthentication.FormsCookieName;

        if (!filterContext.HttpContext.User.Identity.IsAuthenticated ||
            filterContext.HttpContext.Request.Cookies == null ||
            filterContext.HttpContext.Request.Cookies[cookieName] == null
        )
        {
            HandleUnauthorizedRequest(filterContext);
            return;
        }

        var authCookie = filterContext.HttpContext.Request.Cookies[cookieName];
        var authTicket = FormsAuthentication.Decrypt(authCookie.Value);
        string[] roles = authTicket.UserData.Split(',');

        var userIdentity = new GenericIdentity(authTicket.Name);
        var userPrincipal = new GenericPrincipal(userIdentity, roles);

        filterContext.HttpContext.User = userPrincipal;
        base.OnAuthorization(filterContext);
    }
}

然后:

[CustomAuthorize(Roles = "admin")]
public ActionResult DoAdminStuff() 
{
    ...
}

还有一件非常重要的事情是，确保在您登录时发出身份验证 cookie，因为您返回了 XML 文件。当您尝试访问 url /services/doadminstuff 时，使用 FireBug 检查身份验证 cookie 是否正确发送。