blocks|key|3342494|text|实际上还有第三种方法。asp.net成员资格功能基于提供程序模型。您可以编写一个自定义提供程序，从而能够提供您自己的数据存储方式实现，但保留了asp.net成员资格的大部分好处。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3342495|关于这个主题的一些文章：|3342496|http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx|offset|length|3342497|http://www.asp.net/learn/videos/video-189.aspx|3342498|http://www.15seconds.com/issue/050216.htm|3342499|http://davidhayden.com/blog/dave/archive/2007/10/11/CreateCustomMembershipProviderASPNETWebsiteSecurity.aspx|3342500|entityMap|0|LINK|mutability|MUTABLE|url|1|2|3^0|0|0|0|1H|0|0|0|1A|1|0|0|15|2|0|0|30|3|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Z|8|@]|9|@$F|10|G|11|1|12]]|A|$]]|$1|H|3|I|5|6|7|13|8|@]|9|@$F|14|G|15|1|16]]|A|$]]|$1|J|3|K|5|6|7|17|8|@]|9|@$F|18|G|19|1|1A]]|A|$]]|$1|L|3|M|5|6|7|1B|8|@]|9|@$F|1C|G|1D|1|1E]]|A|$]]|$1|N|3|-4|5|6|7|1F|8|@]|9|@]|A|$]]]|O|$P|$5|Q|R|S|A|$T|E]]|U|$5|Q|R|S|A|$T|I]]|V|$5|Q|R|S|A|$T|K]]|W|$5|Q|R|S|A|$T|M]]]]

There is actually a third approach. The asp.net membership functionality is based on the provider model. You can write a custom provider, thus being able to provide your own implementation for how the data is stored, but retaining much of the benefit of asp.net membership.

Some articles on the subject:

<a href="http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx" rel="noreferrer">http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx</a>

<a href="http://www.asp.net/learn/videos/video-189.aspx" rel="noreferrer">http://www.asp.net/learn/videos/video-189.aspx</a>

<a href="http://www.15seconds.com/issue/050216.htm" rel="noreferrer">http://www.15seconds.com/issue/050216.htm</a>

<a href="http://davidhayden.com/blog/dave/archive/2007/10/11/CreateCustomMembershipProviderASPNETWebsiteSecurity.aspx" rel="noreferrer">http://davidhayden.com/blog/dave/archive/2007/10/11/CreateCustomMembershipProviderASPNETWebsiteSecurity.aspx</a>

blocks|key|3129544|text|使用自定义。MembershipProvider对我来说太重了。是的，可以用一种简单的方式来实现它，但是你会得到一个NotSupportedException或NotImplementedException的really+bad+smell。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3129545|使用完全自定义的实现，您仍然可以使用IPrincipal、IIdentity和FormsAuth。做你自己的登录页面真的有多难吗？|3129546|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Liskov_substitution_principle^0|2W|G|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

Go with custom. MembershipProvider is way too heavy for my tastes. Yes it's possible to implement it in a simplified way, but then you get a <a href="http://en.wikipedia.org/wiki/Liskov_substitution_principle" rel="noreferrer">really bad smell</a> of NotSupportedException or NotImplementedException.

With a totally custom implementation you can still use IPrincipal, IIdentity and FormsAuth. And really how hard is it do your own login page and such?

blocks|key|3342541|text|另一种方法是使用ASP.NET成员进行身份验证，将User类链接到ASP.NET成员，并使用User类获得更细粒度的权限。我们这样做，是因为它允许非常容易地更改身份验证提供者，同时仍然保留拥有复杂权限系统的能力。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3342542|一般来说，值得记住的是，身份验证/身份和存储权限不一定是同一个问题。|3342543|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Yet another approach is to use ASP.NET membership for authentication, link your User class to ASP.NET members, and use your User class for more granular permissions. We do this, because it allows changing authentication providers very easily, while still retaining the ability to have a complex permission system.

In general, it's worth remembering that authentication/identity and storing permissions are not necessarily the same problem.

blocks|key|348485|text|您可能会对RPX感兴趣，因为它提供了一个免费的API来验证您的用户|type|unstyled|depth|inlineStyleRanges|entityRanges|data|348486|http://blog.maartenballiauw.be/post/2009/07/27/Authenticating-users-with-RPXNow-(in-ASPNET-MVC).aspx|offset|length|348487|尝试使用ASP.Net+MVC成员资格初学者工具包作为管理API。|style|BOLD|348488|截图|348489|http://www.squaredroot.com/2009/08/07/mvcmembership-release-1-0/|348490|旧位置变更集(历史)|348491|http://mvcmembership.codeplex.com/SourceControl/list/changesets|348492|新位置：|348493|http://github.com/TroyGoode/MembershipStarterKit|348494|entityMap|0|LINK|mutability|MUTABLE|url|1|2|3^0|0|0|2S|0|0|4|L|0|0|2|0|0|1S|1|0|0|A|0|0|1R|2|0|0|4|0|0|1C|3|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|16|8|@]|9|@$D|17|E|18|1|19]]|A|$]]|$1|F|3|G|5|6|7|1A|8|@$D|1B|E|1C|H|I]]|9|@]|A|$]]|$1|J|3|K|5|6|7|1D|8|@$D|1E|E|1F|H|I]]|9|@]|A|$]]|$1|L|3|M|5|6|7|1G|8|@]|9|@$D|1H|E|1I|1|1J]]|A|$]]|$1|N|3|O|5|6|7|1K|8|@$D|1L|E|1M|H|I]]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1N|8|@]|9|@$D|1O|E|1P|1|1Q]]|A|$]]|$1|R|3|S|5|6|7|1R|8|@$D|1S|E|1T|H|I]]|9|@]|A|$]]|$1|T|3|U|5|6|7|1U|8|@]|9|@$D|1V|E|1W|1|1X]]|A|$]]|$1|V|3|-4|5|6|7|1Y|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|C]]|12|$5|Y|Z|10|A|$11|M]]|13|$5|Y|Z|10|A|$11|Q]]|14|$5|Y|Z|10|A|$11|U]]]]

You may be interested in RPX for a free API to authenticate your users

<a href="http://blog.maartenballiauw.be/post/2009/07/27/Authenticating-users-with-RPXNow-(in-ASPNET-MVC).aspx" rel="nofollow">http://blog.maartenballiauw.be/post/2009/07/27/Authenticating-users-with-RPXNow-(in-ASPNET-MVC).aspx</a>

Try the ASP.Net MVC Membership Starter Kit for an administrative API

Screenshots

<a href="http://www.squaredroot.com/2009/08/07/mvcmembership-release-1-0/" rel="nofollow">http://www.squaredroot.com/2009/08/07/mvcmembership-release-1-0/</a>

Old locations changesets (historic) 

<a href="http://mvcmembership.codeplex.com/SourceControl/list/changesets" rel="nofollow">http://mvcmembership.codeplex.com/SourceControl/list/changesets</a>

New Location: 

<a href="http://github.com/TroyGoode/MembershipStarterKit" rel="nofollow">http://github.com/TroyGoode/MembershipStarterKit</a>

blocks|key|349862|text|最简单的方法是使用asp.net用户名作为角色名称。您可以编写自己的authorizarion属性来处理授权：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|349863|public+class+CustomAuthorizationAttribute:AuthorizeAttribute
{
++++public+CustomAuthorizationAttribute():base()
++++{
++++++++Users+=+"registereduser";
++++}
++++protected+override+bool+AuthorizeCore(HttpContextBase+httpContext)
++++{
++++++++//You+must+check+if+the+user+has+logged+in+and+return+true+if+he+did+that.
++++++++return+(bool)(httpContext.Session["started"]??false);+

++++}
++++protected+override+void+HandleUnauthorizedRequest(AuthorizationContext+filterContext)
++++{
++++++++filterContext.HttpContext.Response.Redirect("SessionManagement/Index/?returningURL="+%2B+
++++++++++++filterContext.HttpContext.Server.UrlEncode(filterContext.HttpContext.Request.Url.ToString()));

++++}

}|code-block|syntax|javascript|349864|如果用户启动了会话，代码必须处理AuthorizeCore以返回true，并处理HandleUnauthorizedRequest以将用户重定向到登录页面(可选的，您可以附加返回的url)。|349865|然后在需要授权的控制器方法中，在它们上面设置属性：|349866|public+class+SecretPageController+{
++++[CustomAuthorizationAttribute]
++++ActionResult+Index()+{
++++++++//Method+that+requires+authorization
++++++++return+View();
++++}

}|349867|还要在web配置中将授权方法设置为"Forms“。|349868|Web.config：|349869|++<authentication>
++++++<forms+timeout="120"></forms>
++</authentication>|349870|控制器：|349871|public+SessionManagementController:Controller+{
++++public+ActionResult+Index(string+returningURL)
++++{
++++++++return+View("Index",+new+SessionModel()+{+ReturningURL+=+returningURL});
++++}
++++[HttpPost]++++++++
++++public+ActionResult+Index(SessionModel+mod)
++++{
++++++++if+(UserAuthenticated(mod.UserName,+mod.Password))
++++++++{
++++++++++++FormsAuthentication.SetAuthCookie("registereduser",+false);
++++++++++++if+(mod.UrlRetorno+!=+null)
++++++++++++{
++++++++++++++++return+Redirect(mod.ReturningURL);++++++++++++++++++++
++++++++++++}
++++++++++++return+RedirectToAction("Index",+"StartPage");
++++++++}
++++++++mod.Error+=+"Wrong+User+Name+or+Password";
++++++++return+View(mod);
++++}
++++bool+UserAuthenticated(string+userName,+string+password)+{
+++++++//Write+here+the+authentication+code+(it+can+be+from+a+database,+predefined+users,,+etc)
++++++++return+true;
++++}

++++public+ActionResult+FinishSession()
++++{
++++++++HttpContext.Session.Clear();//Clear+the+session+information
++++++++FormsAuthentication.SignOut();
++++++++return+View(new+NotificacionModel()+{+Message+=+"Session+Finished",+URL+=+Request.Url.ToString()+});
++++}

}|349872|在控制器中，当用户输入其用户名和密码时，将forms身份验证cookie设置为TRUE+(真)，通知用户名(本例中为(FormsAuthentication.SetAuthCookie("registereduser"，)进行身份验证。然后用户注销，调用FormsAuthentication.SignOut()告诉ASP.NET这样做。|349873|型号：|349874|class+SessionModel+{
++++public+string+UserName+{get;set;}
++++public+string+Password+{get;set;}
++++public+string+Error+{get;set;}
}++|349875|使用模型来存储用户数据。|349876|视图(呈现SessionModel类型)：|349877|++++++++<div+class="editor-label">
++++++++++++<%25:+Html.LabelFor(model+=>+model.UserName)+%25>
++++++++</div>
++++++++<div+class="editor-field">
++++++++++++<%25:+Html.TextBoxFor(model+=>+model.UserName)+%25>
++++++++++++<%25:+Html.ValidationMessageFor(model+=>+model.UserName)+%25>
++++++++</div>

++++++++<div+class="editor-label">
++++++++++++<%25:+Html.LabelFor(model+=>+model.Password)+%25>
++++++++</div>
++++++++<div+class="editor-field">
++++++++++++<%25:+Html.TextBoxFor(model+=>+model.Password)+%25>
++++++++++++<%25:+Html.ValidationMessageFor(model+=>+model.Password)+%25>
++++++++</div>
++++++++<div+class="field-validation-error"><%25:Model==null?"":Model.Error??""+%25></div>
++++++++<%25:Html.HiddenFor(model=>model.ReturningURL)+%25>
++++++++<input+type="submit"+value="Log+In"+/>|349878|使用视图获取数据。在此示例中，有一个用于存储返回URL的隐藏字段|349879|我希望这能有所帮助(我不得不翻译代码，所以我不确定它是否100%25正确)。|349880|entityMap^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1E|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1F|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|1G|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1H|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|1I|8|@]|9|@]|A|$E|F]]|$1|M|3|N|5|6|7|1J|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1K|8|@]|9|@]|A|$]]|$1|Q|3|R|5|D|7|1L|8|@]|9|@]|A|$E|F]]|$1|S|3|T|5|6|7|1M|8|@]|9|@]|A|$]]|$1|U|3|V|5|D|7|1N|8|@]|9|@]|A|$E|F]]|$1|W|3|X|5|6|7|1O|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|6|7|1P|8|@]|9|@]|A|$]]|$1|10|3|11|5|D|7|1Q|8|@]|9|@]|A|$E|F]]|$1|12|3|13|5|6|7|1R|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|1S|8|@]|9|@]|A|$]]|$1|16|3|17|5|D|7|1T|8|@]|9|@]|A|$E|F]]|$1|18|3|19|5|6|7|1U|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|6|7|1V|8|@]|9|@]|A|$]]|$1|1C|3|-4|5|6|7|1W|8|@]|9|@]|A|$]]]|1D|$]]

The easiest way is to use asp.net user names as role names.
You can write your own authorizarion attribute to handle authorization:

<pre><code>public class CustomAuthorizationAttribute:AuthorizeAttribute
{
 public CustomAuthorizationAttribute():base()
 {
 Users = "registereduser";
 }
 protected override bool AuthorizeCore(HttpContextBase httpContext)
 {
 //You must check if the user has logged in and return true if he did that.
 return (bool)(httpContext.Session["started"]??false); 

 }
 protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
 {
 filterContext.HttpContext.Response.Redirect("SessionManagement/Index/?returningURL=" + 
 filterContext.HttpContext.Server.UrlEncode(filterContext.HttpContext.Request.Url.ToString()));

 }

}
</code></pre>

The code must handle the AuthorizeCore to return true if the user has started the session, and HandleUnauthorizedRequest to redirect the user to the login page (optionaly you can attach the returning url). 

In then controller methods that need authorization, set the attribute over them:

<pre><code>public class SecretPageController {
 [CustomAuthorizationAttribute]
 ActionResult Index() {
 //Method that requires authorization
 return View();
 }

}
</code></pre>

Also set the authorization method to "Forms" in the web config. 

Web.config:

<pre><code> &lt;authentication&gt;
 &lt;forms timeout="120"&gt;&lt;/forms&gt;
 &lt;/authentication&gt;
</code></pre>

Controller:

<pre><code>public SessionManagementController:Controller {
 public ActionResult Index(string returningURL)
 {
 return View("Index", new SessionModel() { ReturningURL = returningURL});
 }
 [HttpPost] 
 public ActionResult Index(SessionModel mod)
 {
 if (UserAuthenticated(mod.UserName, mod.Password))
 {
 FormsAuthentication.SetAuthCookie("registereduser", false);
 if (mod.UrlRetorno != null)
 {
 return Redirect(mod.ReturningURL); 
 }
 return RedirectToAction("Index", "StartPage");
 }
 mod.Error = "Wrong User Name or Password";
 return View(mod);
 }
 bool UserAuthenticated(string userName, string password) {
 //Write here the authentication code (it can be from a database, predefined users,, etc)
 return true;
 }

 public ActionResult FinishSession()
 {
 HttpContext.Session.Clear();//Clear the session information
 FormsAuthentication.SignOut();
 return View(new NotificacionModel() { Message = "Session Finished", URL = Request.Url.ToString() });
 }

}
</code></pre>

In the Controller, when the user enters its user name and password, set the forms authentication cookie to TRUE (FormsAuthentication.SetAuthCookie("registereduser",true)), signaling the user name (registereduser in the example) to be authenticathed. Then the user signs out, tell ASP.NET to do so calling FormsAuthentication.SignOut().

Model:

<pre><code>class SessionModel {
 public string UserName {get;set;}
 public string Password {get;set;}
 public string Error {get;set;}
} 
</code></pre>

Use a model to store the user data.

View (that presents the SessionModel type):

<pre><code> &lt;div class="editor-label"&gt;
 &lt;%: Html.LabelFor(model =&gt; model.UserName) %&gt;
 &lt;/div&gt;
 &lt;div class="editor-field"&gt;
 &lt;%: Html.TextBoxFor(model =&gt; model.UserName) %&gt;
 &lt;%: Html.ValidationMessageFor(model =&gt; model.UserName) %&gt;
 &lt;/div&gt;

 &lt;div class="editor-label"&gt;
 &lt;%: Html.LabelFor(model =&gt; model.Password) %&gt;
 &lt;/div&gt;
 &lt;div class="editor-field"&gt;
 &lt;%: Html.TextBoxFor(model =&gt; model.Password) %&gt;
 &lt;%: Html.ValidationMessageFor(model =&gt; model.Password) %&gt;
 &lt;/div&gt;
 &lt;div class="field-validation-error"&gt;&lt;%:Model==null?"":Model.Error??"" %&gt;&lt;/div&gt;
 &lt;%:Html.HiddenFor(model=&gt;model.ReturningURL) %&gt;
 &lt;input type="submit" value="Log In" /&gt;
</code></pre>

Use a view to get the data. In this example, there is a hidden field to store the returning URL

I hope this helps (I had to translate the code, so I'm not sure if it is 100% correct).

blocks|key|348532|text|这是第四种方法。使用web+matrix+security+classes，您可以使用简单的成员提供程序，它可以使用EF，因此用户和角色可以是您的域模型的一部分，也可以是IPrincipal和IIdentity+MVC+helper的一部分。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|348533|我已经创建了一个example+Github+project，看看如何将其与自动自助注册和电子邮件注册/密码重置等功能一起使用。|348534|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/webmatrix.webdata.simplemembershipprovider%2528v=vs.111%2529.aspx|1|https://github.com/ACassells/SimpleAuth^0|A|R|0|0|8|M|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]]]

This is a forth approach. Using the <a href="http://msdn.microsoft.com/en-us/library/webmatrix.webdata.simplemembershipprovider%28v=vs.111%29.aspx" rel="nofollow">web matrix security classes</a> you can use simple membership provider which can use EF so users and roles can be part of your domain model but also part of the IPrincipal and IIdentity MVC helpers. 

I have created an <a href="https://github.com/ACassells/SimpleAuth" rel="nofollow">example Github project</a> to see how this can be used with automated self registration and email signup / password reset and the like.

What is the best method for user authorisation/authentication in ASP.NET MVC?

I see there are really two approaches: 

<ul>
<li>Use the built-in ASP.NET authorisation system.</li>
<li>Use a custom system with my own User, Permission, UserGroup tables etc.</li>
</ul>

I'd prefer the second option, because User is part of my domain model (and I have zero experience with ASP.NET's built-in stuff), but I'd really like to hear what people have been doing in this area.

User authentication and authorisation in ASP.NET MVC

身份验证

数据存储

在ASP.NET MVC中进行用户授权/认证的最佳方法是什么？我看到实际上有两种方法：使用内置的ASP.NET授权系统。使用具有我自己的用户、权限、UserGroup表等的自定义系统。我更倾向于第二种选择，因为User是我的域模型的一部分(而且我对ASP.Net的内置内容有zero的经验)，但我真的很想知道人们在这方面...

问ASP.NET MVC中的用户身份验证和授权
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC中的用户身份验证和授权EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC中的用户身份验证和授权
EN