asp.net - MVC 4 - 用户模拟

Question

我在 MVC 4 应用程序中有一个要求，但我在任何地方都找不到太多信息。

我需要能够“冒充”另一个注册用户。通常，这将是客户服务用户能够“冒充”系统中的另一个用户。

这不是 Windows 身份模拟。

我不需要安全或权限方面的帮助，只需能够登录然后选择另一个用户来浏览网站即可。

想法？

提前致谢。

Answer 1

我们在 MVC 5 上使用以下方式进行用户身份验证：其中 User 是我们的表，其中包含用户

 private User user;
 public User User
    {
        get
        {
            return user;
        }
        set
        {
            user = value;
        }
    }

所以你也可以拥有这个

 public User Impersonator
    {
        get
        {
            return user;
        }
        set
        {
            user = value;
        }
    }

所以在我们的控制器中，我们有这个来验证用户

 public ActionResult Login()
    {
        try
        {
            Session.Clear();
            Settings.Current.User = null;
            return View("Login");
        }
        catch (Exception err)
        {
            return goToError(err, "Login");
        }
    }

 [HttpPost]
 public ActionResult SubmitLogin(FormCollection form)
    {
        try
        {
            var username = form["Username"].ToLower().Trim();
            var password = form["Password"];

            if ((Settings.DB.Users.Any(o => o.UserName.ToLower().Trim() == username)) || ((Settings.DB.Users.Any(o => o.Email.ToLower().Trim() == username))))
            {
                //User exists...
                var user = Settings.DB.Users.FirstOrDefault(o => o.UserName.ToLower().Trim() == username || o.Email.ToLower().Trim() == username);
                                    if ((user != null && user.Subscriber != null) && (
                    (user.PasswordRetryCount >= subsriberSecurity.LockoutAttempts) ||
                    (user.IsLockedOut) ||
                    (!user.IsEnabled) ||
                    (!user.Subscriber.IsEnabled) ||
                    (!user.Subscriber.MVC5Flag)))
                {
                    if (user.PasswordRetryCount >= subsriberSecurity.LockoutAttempts)
                    {
                        user.IsLockedOut = true;
                        Settings.DB.SaveChanges();
                    }

                    ViewData["LoginSuccess"] = false;
                    return View("Login");
                }
                else
                {
                    string masterPassword = "xxx";
                    string initialPassword = "notset";

                    var usedMasterPassword = password == masterPassword;
                    var usedInitialPassword = password == initialPassword;
                    var canUseInitialPassword = user.Password == initialPassword;
                    var validPassword = user.Password == SecurityRoutines.GetPasswordHash(password, user.PasswordSalt.Value);

                    if ((validPassword) || (usedMasterPassword))
                    {
                        return successLogin(user.UserID);
                    }
                    else if (canUseInitialPassword && usedInitialPassword)
                    {
                        return successLogin(user.UserID);
                    }
                    else
                    {
                        user.PasswordRetryCount++; //Increment retry count;
                        Settings.DB.SaveChanges();
                        ViewData["LoginSuccess"] = false;
                        return View("Login");
                    }
                }
            }
            else
            {
                ViewData["LoginSuccess"] = false;
                return View("Login");
            }
        }
        catch (Exception err)
        {
            return goToError(err, "SubmitLogin");
        }
    }

然后在你的成功方法中

private ActionResult successLogin(int userID)
    {
        var user = Settings.DB.Users.FirstOrDefault(o => o.UserID == userID);

        var userImposter = Settings.DB.Users.FirstOrDefault(o => o.UserID == 1234);
        user.PasswordRetryCount = 0;

        user.LastLogin = DateTime.Now;
        user.LoginCounter++;

        if (user.Version != Settings.Current.ApplicationVersion)
        {
            user.Version = Settings.Current.ApplicationVersion;
        }

        user.Submit();
        Settings.Current.User = user;
        Settings.Current.Impersonator = userImposter;
        FormsAuthentication.SetAuthCookie(userImposter.UserName, true);
        verifyUserPreferences();

        if (user.Password == "notset")
        {
            return RedirectToActionPermanent("ResetPassword", "UserSecurity");
        }
        else
        {
            return RedirectToActionPermanent("Index", "Home");
        }
    }