0

I'm building a couple of ASP.NET MVC websites that will share a database (because they share data under the hood). That said, logins between sites will not be shared at the moment. For reference, I'm using NHibernate for data access with SQL Server under the hood (currently).

As currently laid out, the system has tables for Sites, Roles, Users, and Rights. Sites have sets of users, rights, and roles. Users can be in many roles. Roles have a set of rights. Users will be able to sign in with a username and password, but I don't want to paint myself into a corner - I might want them to be able to use a google or facebook login later.

Now, I'm a little confused as to which path to take with regard to securing the site. I'm not enamored of the old school membership and role providers for several reasons. Chief among these is that I won't be restricting very many things by roles; things will be restricted based on user access rights. I'm looking at the following few scenarios for authentication. 1) I want to be able to specify rights required to use a controller method via an attribute. 2) I want to be able to quickly query and see if a user is in a particular role or has a particular right.

So, I actually have a set of questions, but they are kind of intertangled. First, what should I do? Just a custom authorization attribute? Second, what's the workflow on login and the like? What are the steps required for this to work properly and securely?

I realize these are sort of noobish questions, but in the past I've gotten by with the old provider way of doing things. I don't particularly care for that and would really like some better suggestions. So I guess everything old is new again for me.

4

1 回答 1

0

我会像害虫一样逃离 MS 的会员资格提供者。当它与 .NET 2.0 一起出现时，它已经很糟糕地实现了，最近的更新也好不到哪里去。

角色，用户，.. 不受会员资格提供者的约束，您可以自己使用它们。设置身份验证，创建一个处理所述身份验证的 httmodule（Context.User.Identity 的简单 userId 就足够了）

您所需要的只是一个从 IIdentity 和您的 httmodule 中派生的用户

string[] roles = new[] {"Admin", "CoolDude"};
HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(user, roles);

..现在在您的 mvc 控制器中只需添加必要的身份验证属性，就可以玩了！

制作自定义角色、自定义 mvc 属性，或者直接查询用户是否属于特定角色

if (HttpContext.Current.User.IsInRole("Admin")) { ...
于 2013-07-14T21:43:47.027 回答