c# - 自定义授权中的 MVC 4.0 FormsAuthentication 和 AuthorizeAttribute

Question

我正在使用 MVC4，我正在尝试修改用于验证用户身份并为用户分配角色的分配过程。对于属性 [Authorize (Users = "adminadmin")] 一切正常，但是 [Authorize (Roles = "Admin")] 每次都有一个登录页面以及无法访问。

Global.asax.cs:

protected void Application_AuthenticateRequest(object sender, EventArgs e)
        {
            // look if any security information exists for this request
            if (HttpContext.Current.User != null)
            {
                // see if this user is authenticated, any authenticated cookie (ticket) exists for this user
                if (HttpContext.Current.User.Identity.IsAuthenticated)
                {
                    // see if the authentication is done using FormsAuthentication
                    if (HttpContext.Current.User.Identity is FormsIdentity)
                    {
                        // Get the roles stored for this request from the ticket
                        // get the identity of the user
                        FormsIdentity identity = (FormsIdentity)HttpContext.Current.User.Identity;
                        //Get the form authentication ticket of the user
                        FormsAuthenticationTicket ticket = identity.Ticket;
                        //Get the roles stored as UserData into ticket
                        List<string> roles = new List<string>();
                        if (identity.Name == "adminadmin")
                            roles.Add("Admin");
                        //Create general prrincipal and assign it to current request

                        HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(identity, roles.ToArray());
                    }
                }
            }
        }

账户 Controller :

[InitializeSimpleMembership]
public class AccountController : Controller
{
public ActionResult Login()
{
    return View();
}

[HttpPost]
public ActionResult Login(LoginModel model, string returnUrl)
{
    // Lets first check if the Model is valid or not
    if (ModelState.IsValid)
    {
            string username = model.UserName;
            string password = model.Password;

            bool userValid = username == password ? true : false;

            // User is valid
            if (userValid)
            {

                FormsAuthentication.SetAuthCookie(username, false);
                if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                    && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction("Index", "Home");
                }
            }
            else
            {
                ModelState.AddModelError("", "The user name or password provided is incorrect.");
            }
    }

    // If we got this far, something failed, redisplay form
    return View(model);
}

public ActionResult LogOff()
{
    FormsAuthentication.SignOut();

    return RedirectToAction("Index", "Home");
}

HomeController.cs:

 public class HomeController : Controller
    {
        [AllowAnonymous]
        public ActionResult Index()
        {
            ViewBag.Message = "Modify this template to jump-start your ASP.NET MVC application.";

            return View();
        }

        [Authorize]
        public ActionResult About()
        {
            ViewBag.Message = "Your app description page.";

            return View();
        }

        [Authorize(Roles = "Admin")]
        public ActionResult Contact()
        {
            ViewBag.Message = "Your contact page.";

            return View();
        }
    }

网络配置:

(...)
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login" timeout="2880"/>
    </authentication>
(...)

Answer 1

你快到了。现在正在发生的事情是您将主体设置为自定义主体，SimpleMembership 提供程序在您之后出现并通过将其设置为 System.Web.Security.RolePrincipal 来取消您的主体。将您当前的 Application_AuthenticateRequest 代码移动到新的 Application_PostAuthenticateRequest 处理程序中，您的自定义主体将保留在原位。