blocks|key|1021430|text|您不需要为角色使用静态类。例如，SqlRoleProvider允许您定义数据库中的角色。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1021431|当然，如果您想从您自己的服务层检索角色，那么创建您自己的角色提供程序并不是那么困难--实际上并没有那么多方法可以实现。|1021432|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/system.web.security.sqlroleprovider.aspx^0|G|F|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

You don't need to use a static class for roles. For instance, the <a href="http://msdn.microsoft.com/en-us/library/system.web.security.sqlroleprovider.aspx" rel="nofollow">SqlRoleProvider</a> allows you to define the roles in a database.

Of course, if you want to retrieve roles from your own service layer, it's not that hard to create your own role provider - there really aren't that many methods to implement.

blocks|key|806795|text|您可以通过重写相应的接口来实现您自己的membership和role提供程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|806796|如果您想从头开始，通常将这些类型的内容实现为custom+http+module，它将用户凭证存储在httpcontext或session中。无论采用哪种方式，您都可能希望使用某种身份验证令牌来设置cookie。|806797|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx|1|http://msdn.microsoft.com/en-us/library/8fw7xh74.aspx|2|http://msdn.microsoft.com/en-us/library/ms227673.aspx^0|J|A|0|U|4|1|0|M|I|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]|$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]|P|$5|I|J|K|C|$L|Q]]]]

You can implement your own <a href="http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx" rel="nofollow">membership</a> and <a href="http://msdn.microsoft.com/en-us/library/8fw7xh74.aspx" rel="nofollow">role</a> providers by overriding the appropriate interfaces.

If you want to start from scratch, typically these types of things are implemented as a <a href="http://msdn.microsoft.com/en-us/library/ms227673.aspx" rel="nofollow">custom http module</a> which stores the users credentials either in the httpcontext or the session. Either way you'll probably want to set a cookie with some sort of authentication token.

blocks|key|806858|text|我在这里实现了一个基于@TheCloudlessSky帖子的角色提供者。我认为我可以添加和分享我所做的事情的事情很少。首先，如果您希望将动作过滤器的RequirepPermission类用作属性，则需要为RequirepPermission类实现ActionFilterAttribute类。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|806859|接口类IAuthenticationService和IAuthorizationService|806860|public+interface+IAuthenticationService
{
++++void+SignIn(string+userName,+bool+createPersistentCookie);
++++void+SignOut();
}

public+interface+IAuthorizationService
{
++++bool+Authorize(UserSession+user,+string[]+requiredRoles);
}|code-block|syntax|javascript|806861|FormsAuthenticationService类|806862|///+<summary>
///+This+class+is+for+Form+Authentication
///+</summary>
public+class+FormsAuthenticationService+:+IAuthenticationService
{

++++public+void+SignIn(string+userName,+bool+createPersistentCookie)
++++{
++++++++if+(String.IsNullOrEmpty(userName))+throw+new+ArgumentException(@"Value+cannot+be+null+or+empty.",+"userName");

++++++++FormsAuthentication.SetAuthCookie(userName,+createPersistentCookie);
++++}

++++public+void+SignOut()
++++{
++++++++FormsAuthentication.SignOut();
++++}
}|806863|UserSession类|806864|public+class+UserSession
{
++++public+string+UserName+{+get;+set;+}
++++public+IEnumerable<string>+UserRoles+{+get;+set;+}
}|806865|另一个要点是FormsAuthorizationService类，以及如何将用户分配给httpContext.Session["CurrentUser"]。在这种情况下，我的方法是创建一个userSession类的新实例，并将httpContext.User.Identity.Name中的用户直接分配给userSession变量，如FormsAuthorizationService类中所示。|806866|[AttributeUsageAttribute(AttributeTargets.Class+%7C+AttributeTargets.Struct+%7C+AttributeTargets.Constructor+%7C+AttributeTargets.Method,+Inherited+=+false)]
public+class+RequirePermissionAttribute+:+ActionFilterAttribute,+IAuthorizationFilter
{
++++#region+Fields

++++private+readonly+IAuthorizationService+_authorizationService;
++++private+readonly+string[]+_permissions;

++++#endregion

++++#region+Constructors

++++public+RequirePermissionAttribute(string+requiredRoles)
++++{
++++++++_permissions+=+requiredRoles.Trim().Split(',').ToArray();
++++++++_authorizationService+=+null;
++++}

++++#endregion

++++#region+Methods

++++private+IAuthorizationService+CreateAuthorizationService(HttpContextBase+httpContext)
++++{
++++++++return+_authorizationService+??+new+FormsAuthorizationService(httpContext);
++++}

++++public+void+OnAuthorization(AuthorizationContext+filterContext)
++++{
++++++++var+authSvc+=+CreateAuthorizationService(filterContext.HttpContext);
++++++++//+Get+the+current+user...+you+could+store+in+session+or+the+HttpContext+if+you+want+too.+It+would+be+set+inside+the+FormsAuthenticationService.
++++++++if+(filterContext.HttpContext.Session+==+null)+return;
++++++++if+(filterContext.HttpContext.Request+==+null)+return;
++++++++var+success+=+false;
++++++++if+(filterContext.HttpContext.Session["__Roles"]+!=+null)
++++++++{
++++++++++++var+rolesSession+=+filterContext.HttpContext.Session["__Roles"];
++++++++++++var+roles+=+rolesSession.ToString().Trim().Split(',').ToList();
++++++++++++var+userSession+=+new+UserSession
++++++++++++{
++++++++++++++++UserName+=+filterContext.HttpContext.User.Identity.Name,
++++++++++++++++UserRoles+=+roles
++++++++++++};
++++++++++++success+=+authSvc.Authorize(userSession,+_permissions);
++++++++}
++++++++if+(success)
++++++++++++{
++++++++++++++++//+Since+authorization+is+performed+at+the+action+level,+the+authorization+code+runs
++++++++++++++++//+after+the+output+caching+module.+In+the+worst+case+this+could+allow+an+authorized+user
++++++++++++++++//+to+cause+the+page+to+be+cached,+then+an+unauthorized+user+would+later+be+served+the
++++++++++++++++//+cached+page.+We+work+around+this+by+telling+proxies+not+to+cache+the+sensitive+page,
++++++++++++++++//+then+we+hook+our+custom+authorization+code+into+the+caching+mechanism+so+that+we+have
++++++++++++++++//+the+final+say+on+whether+or+not+a+page+should+be+served+from+the+cache.
++++++++++++++++var+cache+=+filterContext.HttpContext.Response.Cache;
++++++++++++++++cache.SetProxyMaxAge(new+TimeSpan(0));
++++++++++++++++cache.AddValidationCallback((HttpContext+context,+object+data,+ref+HttpValidationStatus+validationStatus)+=>
++++++++++++++++++++++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++++++++++++++++++++++validationStatus+=+OnCacheAuthorization(new+HttpContextWrapper(context));
++++++++++++++++++++++++++++++++++++++++++++++++},+null);
++++++++++++}
++++++++++++else
++++++++++++{
++++++++++++++++HandleUnauthorizedRequest(filterContext);
++++++++++++}
++++}

++++private+static+void+HandleUnauthorizedRequest(AuthorizationContext+filterContext)
++++{
++++++++//+Ajax+requests+will+return+status+code+500+because+we+don't+want+to+return+the+result+of+the
++++++++//+redirect+to+the+login+page.
++++++++if+(filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
++++++++{
++++++++++++filterContext.Result+=+new+HttpStatusCodeResult(500);
++++++++}
++++++++else
++++++++{
++++++++++++filterContext.Result+=+new+HttpUnauthorizedResult();
++++++++}
++++}

++++private+HttpValidationStatus+OnCacheAuthorization(HttpContextBase+httpContext)
++++{
++++++++var+authSvc+=+CreateAuthorizationService(httpContext);
++++++++if+(httpContext.Session+!=+null)
++++++++{
++++++++++++var+success+=+false;
++++++++++++if+(httpContext.Session["__Roles"]+!=+null)
++++++++++++{
++++++++++++++++var+rolesSession+=+httpContext.Session["__Roles"];
++++++++++++++++var+roles+=+rolesSession.ToString().Trim().Split(',').ToList();
++++++++++++++++var+userSession+=+new+UserSession
++++++++++++++++{
++++++++++++++++++++UserName+=+httpContext.User.Identity.Name,
++++++++++++++++++++UserRoles+=+roles
++++++++++++++++};
++++++++++++++++success+=+authSvc.Authorize(userSession,+_permissions);
++++++++++++}
++++++++++++return+success+?+HttpValidationStatus.Valid+:+HttpValidationStatus.IgnoreThisRequest;
++++++++}
++++++++return+0;
++++}

++++#endregion
}

internal+class+FormsAuthorizationService+:+IAuthorizationService
{
++++private+readonly+HttpContextBase+_httpContext;

++++public+FormsAuthorizationService(HttpContextBase+httpContext)
++++{
++++++++_httpContext+=+httpContext;
++++}

++++public+bool+Authorize(UserSession+userSession,+string[]+requiredRoles)
++++{
++++++++return+userSession.UserRoles.Any(role+=>+requiredRoles.Any(item+=>+item+==+role));
++++}
}|806867|然后在您的控制器中，在用户通过身份验证后，您可以从数据库中获取角色，并将其分配给角色会话：|806868|var+roles+=+Repository.GetRolesByUserId(Id);
if+(ControllerContext.HttpContext.Session+!=+null)
+++ControllerContext.HttpContext.Session.Add("__Roles",roles);
FormsService.SignIn(collection.Name,+true);|806869|用户从系统注销后，您可以清除会话|806870|FormsService.SignOut();
Session.Abandon();
return+RedirectToAction("Index",+"Account");|806871|此模型中的警告是，当用户登录到系统时，如果为用户分配了角色，则除非用户注销并重新登录系统，否则授权将不起作用。|806872|另一件事是，角色不需要单独的类，因为我们可以直接从数据库中获取角色，并将其设置为控制器中的角色会话。|806873|完成所有这些代码的实现后，最后一步是将此属性绑定到控制器中的方法：|806874|[RequirePermission("Admin,DM")]
public+ActionResult+Create()
{
return+View();
}|806875|entityMap^0|22|I|2U|I|3F|L|0|3|M|Q|L|0|0|0|Q|0|0|0|B|0|0|6|P|17|Y|35|U|4N|P|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1G|8|@$9|1H|A|1I|B|C]|$9|1J|A|1K|B|C]|$9|1L|A|1M|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1N|8|@$9|1O|A|1P|B|C]|$9|1Q|A|1R|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|1S|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1T|8|@$9|1U|A|1V|B|C]]|D|@]|E|$]]|$1|O|3|P|5|J|7|1W|8|@]|D|@]|E|$K|L]]|$1|Q|3|R|5|6|7|1X|8|@$9|1Y|A|1Z|B|C]]|D|@]|E|$]]|$1|S|3|T|5|J|7|20|8|@]|D|@]|E|$K|L]]|$1|U|3|V|5|6|7|21|8|@$9|22|A|23|B|C]|$9|24|A|25|B|C]|$9|26|A|27|B|C]|$9|28|A|29|B|C]]|D|@]|E|$]]|$1|W|3|X|5|J|7|2A|8|@]|D|@]|E|$K|L]]|$1|Y|3|Z|5|6|7|2B|8|@]|D|@]|E|$]]|$1|10|3|11|5|J|7|2C|8|@]|D|@]|E|$K|L]]|$1|12|3|13|5|6|7|2D|8|@]|D|@]|E|$]]|$1|14|3|15|5|J|7|2E|8|@]|D|@]|E|$K|L]]|$1|16|3|17|5|6|7|2F|8|@]|D|@]|E|$]]|$1|18|3|19|5|6|7|2G|8|@]|D|@]|E|$]]|$1|1A|3|1B|5|6|7|2H|8|@]|D|@]|E|$]]|$1|1C|3|1D|5|J|7|2I|8|@]|D|@]|E|$K|L]]|$1|1E|3|-4|5|6|7|2J|8|@]|D|@]|E|$]]]|1F|$]]

I have implemented a role provider based on @TheCloudlessSky post here. There are few things that I thought I can add and share what I have done.
First if you want to use the <code>RequirepPermission</code> class for your action filters as an attribute you need to implement <code>ActionFilterAttribute</code> class for <code>RequirepPermission</code> class.

Interface classes <code>IAuthenticationService</code> and <code>IAuthorizationService</code>

<pre><code>public interface IAuthenticationService
{
 void SignIn(string userName, bool createPersistentCookie);
 void SignOut();
}

public interface IAuthorizationService
{
 bool Authorize(UserSession user, string[] requiredRoles);
}
</code></pre>

<code>FormsAuthenticationService</code> class

<pre><code>/// &lt;summary&gt;
/// This class is for Form Authentication
/// &lt;/summary&gt;
public class FormsAuthenticationService : IAuthenticationService
{

 public void SignIn(string userName, bool createPersistentCookie)
 {
 if (String.IsNullOrEmpty(userName)) throw new ArgumentException(@"Value cannot be null or empty.", "userName");

 FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);
 }

 public void SignOut()
 {
 FormsAuthentication.SignOut();
 }
}
</code></pre>

<code>UserSession</code> calss

<pre><code>public class UserSession
{
 public string UserName { get; set; }
 public IEnumerable&lt;string&gt; UserRoles { get; set; }
}
</code></pre>

Another point is <code>FormsAuthorizationService</code>class and how we can assign a user to the <code>httpContext.Session["CurrentUser"]</code>. My Approach in this situation is to create a new instance of userSession class and directly assign the user from <code>httpContext.User.Identity.Name</code> to the userSession variable as you can see in <code>FormsAuthorizationService</code> class.

<pre><code>[AttributeUsageAttribute(AttributeTargets.Class | AttributeTargets.Struct | AttributeTargets.Constructor | AttributeTargets.Method, Inherited = false)]
public class RequirePermissionAttribute : ActionFilterAttribute, IAuthorizationFilter
{
 #region Fields

 private readonly IAuthorizationService _authorizationService;
 private readonly string[] _permissions;

 #endregion

 #region Constructors

 public RequirePermissionAttribute(string requiredRoles)
 {
 _permissions = requiredRoles.Trim().Split(',').ToArray();
 _authorizationService = null;
 }

 #endregion

 #region Methods

 private IAuthorizationService CreateAuthorizationService(HttpContextBase httpContext)
 {
 return _authorizationService ?? new FormsAuthorizationService(httpContext);
 }

 public void OnAuthorization(AuthorizationContext filterContext)
 {
 var authSvc = CreateAuthorizationService(filterContext.HttpContext);
 // Get the current user... you could store in session or the HttpContext if you want too. It would be set inside the FormsAuthenticationService.
 if (filterContext.HttpContext.Session == null) return;
 if (filterContext.HttpContext.Request == null) return;
 var success = false;
 if (filterContext.HttpContext.Session["__Roles"] != null)
 {
 var rolesSession = filterContext.HttpContext.Session["__Roles"];
 var roles = rolesSession.ToString().Trim().Split(',').ToList();
 var userSession = new UserSession
 {
 UserName = filterContext.HttpContext.User.Identity.Name,
 UserRoles = roles
 };
 success = authSvc.Authorize(userSession, _permissions);
 }
 if (success)
 {
 // Since authorization is performed at the action level, the authorization code runs
 // after the output caching module. In the worst case this could allow an authorized user
 // to cause the page to be cached, then an unauthorized user would later be served the
 // cached page. We work around this by telling proxies not to cache the sensitive page,
 // then we hook our custom authorization code into the caching mechanism so that we have
 // the final say on whether or not a page should be served from the cache.
 var cache = filterContext.HttpContext.Response.Cache;
 cache.SetProxyMaxAge(new TimeSpan(0));
 cache.AddValidationCallback((HttpContext context, object data, ref HttpValidationStatus validationStatus) =&gt;
 {
 validationStatus = OnCacheAuthorization(new HttpContextWrapper(context));
 }, null);
 }
 else
 {
 HandleUnauthorizedRequest(filterContext);
 }
 }

 private static void HandleUnauthorizedRequest(AuthorizationContext filterContext)
 {
 // Ajax requests will return status code 500 because we don't want to return the result of the
 // redirect to the login page.
 if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
 {
 filterContext.Result = new HttpStatusCodeResult(500);
 }
 else
 {
 filterContext.Result = new HttpUnauthorizedResult();
 }
 }

 private HttpValidationStatus OnCacheAuthorization(HttpContextBase httpContext)
 {
 var authSvc = CreateAuthorizationService(httpContext);
 if (httpContext.Session != null)
 {
 var success = false;
 if (httpContext.Session["__Roles"] != null)
 {
 var rolesSession = httpContext.Session["__Roles"];
 var roles = rolesSession.ToString().Trim().Split(',').ToList();
 var userSession = new UserSession
 {
 UserName = httpContext.User.Identity.Name,
 UserRoles = roles
 };
 success = authSvc.Authorize(userSession, _permissions);
 }
 return success ? HttpValidationStatus.Valid : HttpValidationStatus.IgnoreThisRequest;
 }
 return 0;
 }

 #endregion
}

internal class FormsAuthorizationService : IAuthorizationService
{
 private readonly HttpContextBase _httpContext;

 public FormsAuthorizationService(HttpContextBase httpContext)
 {
 _httpContext = httpContext;
 }

 public bool Authorize(UserSession userSession, string[] requiredRoles)
 {
 return userSession.UserRoles.Any(role =&gt; requiredRoles.Any(item =&gt; item == role));
 }
}
</code></pre>

then in your controller after the user is authenticated you can get roles from the database and assign it to the roles session:

<pre><code>var roles = Repository.GetRolesByUserId(Id);
if (ControllerContext.HttpContext.Session != null)
 ControllerContext.HttpContext.Session.Add("__Roles",roles);
FormsService.SignIn(collection.Name, true);
</code></pre>

After the user is logged out of the system you can clear the session

<pre><code>FormsService.SignOut();
Session.Abandon();
return RedirectToAction("Index", "Account");
</code></pre>

The caveat in this model is that, when the user is signed into the system, if a role is assigned to the user, authorization doesn't work unless he logs out and logs back in the system.

Another thing is that there is no need to have a separate class for roles, since we can get roles directly from database and set it into roles session in a controller.

After you are done with implementing all these codes one last step is to bind this attribute to your methods in your controller:

<pre><code>[RequirePermission("Admin,DM")]
public ActionResult Create()
{
return View();
}
</code></pre>

blocks|key|806915|text|如果您使用Castle+Windsor依赖注入，则可以注入RoleProviders列表，这些列表可用于确定您选择实现的任何来源的用户权限。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|806916|http://ivida.co.uk/2011/05/18/mvc-getting-user-roles-from-multiple-sources-register-and-resolve-arrays-of-dependencis-using-the-fluent-api/|offset|length|806917|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|3V|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

If you use Castle Windsor Dependency Injection you can inject lists of RoleProviders that can be used to ascertain user rights from any source you choose to implement.

<a href="http://ivida.co.uk/2011/05/18/mvc-getting-user-roles-from-multiple-sources-register-and-resolve-arrays-of-dependencis-using-the-fluent-api/" rel="nofollow">http://ivida.co.uk/2011/05/18/mvc-getting-user-roles-from-multiple-sources-register-and-resolve-arrays-of-dependencis-using-the-fluent-api/</a>

I'm trying to avoid the use of the Role Provider and Membership Provider since its way too clumsy in my opinion, and therefore I'm trying to making my own "version" which is less clumsy and more manageable/flexible. Now is my question.. is there an alternative to the Role Provider which is decent? (I know that I can do custom Role provier, membership provider etc.)

By more manageable/flexible I mean that I'm limited to use the Roles static class and not implement directly into my service layer which interact with the database context, instead I'm bound to use the Roles static class which has its own database context etc, also the table names is awful..

Thanks in advance.

ASP.NET MVC - Alternative to Role Provider?

我试图避免使用角色提供程序和成员提供程序，因为在我看来它的方式太笨拙了，因此我试图制作我自己的“版本”，它不那么笨拙，更容易管理/灵活。现在是我的问题..有没有合适的角色提供者的替代方案？(我知道我可以自定义角色提供者、成员资格提供者等)所谓更易管理/更灵活，我的意思是我只能使用Roles静态类，而不是直接实现到与数据...

问ASP.NET MVC -角色提供者的替代方案？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC -角色提供者的替代方案？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC -角色提供者的替代方案？
EN