asp.net-mvc - MVC自定义roleprovider如何将其连接到HttpContext.Current.User.IsInRole ("myrole")

Question

我有一个 MVC 应用程序，我为其编写了一个自定义角色提供程序，如下所示:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Security;
using VectorCheck.Models;

namespace VectorCheck.Security
{
    public class MyRoleProvider : RoleProvider
    {
        private VectorCheckRepository<User> _repository { get; set; }

        public MyRoleProvider()
        {
            _repository = new VectorCheckRepository<User>();
        }

        public MyRoleProvider(VectorCheckRepository<User> repository)
        {
            _repository = repository;
        }

        public override void AddUsersToRoles(string[] usernames, string[] roleNames)
        {
            throw new NotImplementedException();
        }

        public override string ApplicationName
        {
            get
            {
                throw new NotImplementedException();
            }
            set
            {
                throw new NotImplementedException();
            }
        }

        public override void CreateRole(string roleName)
        {
            throw new NotImplementedException();
        }

        public override bool DeleteRole(string roleName, bool throwOnPopulatedRole)
        {
            throw new NotImplementedException();
        }

        public override string[] FindUsersInRole(string roleName, string usernameToMatch)
        {
            throw new NotImplementedException();
        }

        public override string[] GetAllRoles()
        {
            throw new NotImplementedException();
        }

        public override string[] GetRolesForUser(string username)
        {
            var user = _repository.GetUser(username);

            return new string[] { user.Role.Name };
        }

        public override string[] GetUsersInRole(string roleName)
        {
            throw new NotImplementedException();
        }

        public override bool IsUserInRole(string username, string roleName)
        {
            var user = _repository.GetUser(username);

            return string.Compare(user.Role.Name, roleName, true) == 0;
        }

        public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames)
        {
            throw new NotImplementedException();
        }

        public override bool RoleExists(string roleName)
        {
            throw new NotImplementedException();
        }
    }
}

这对于限制对 Controller 和操作的访问非常有效，使用:

[Authorize(Roles = "Administrator")]

Controller 或操作上方。

我还想通过使用以下方式限制对 View 中某些内容的访问:

HttpContext.Current.User.IsInRole("Administrator")

此方法不是我的角色提供程序的一部分，因此不会被覆盖。

有谁知道这个方法该怎么做吗？

Answer 1

如果您已将 RoleProvider 作为 web.config 中应用程序的角色提供者 Hook ，那么这应该会自动工作；该框架将在请求开始时为经过身份验证的用户创建一个 RolePrincipal，该请求将调用角色提供程序上的 GetRolesForUser 方法，并传递来自 IIdentity 的名称 作为用户名。

RolePrincipal 的 IsInRole(string role) 方法的框架实现是这样的(我已添加注释)

public bool IsInRole(string role) 
{ 
    if (_Identity == null)
        throw new ProviderException(SR.GetString(SR.Role_Principal_not_fully_constructed)); 

    if (!_Identity.IsAuthenticated || role == null)
        return false;
    role = role.Trim(); 
    if (!IsRoleListCached) {
        _Roles.Clear(); 

        // here the RoleProvider is used to get the roles for the user
        // and are cached in a collection on the RolePrincipal so that
        // they are only fetched once per request
        string[] roles = Roles.Providers[_ProviderName].GetRolesForUser(Identity.Name); 
        foreach(string roleTemp in roles)
            if (_Roles[roleTemp] == null) 
                _Roles.Add(roleTemp, String.Empty);

        _IsRoleListCached = true;
        _CachedListChanged = true; 
    }
    return _Roles[role] != null; 
} 

在 RoleProvider GetRolesForUser 方法内设置断点，以确保正确调用该方法并检查 IPrincipal (HttpContext.Current.User code>) 以确保其类型为经过身份验证的用户的 RolePrincipal。