0

I have been having trouble with using roles based Authentication in my project.

I have set-up some roles and linked them to a user.

This works:

 [Authorize]    
public class UsersController : Controller
{}

If I am not logged in it asks me to login.

However If I change it to:

 [Authorize(Roles = "ManageUsers")]    
public class UsersController : Controller
{}

And I try access it from the user with that role It asks me to login.

So I did some goggling and I found this post: Link and they suggested to add:

 <roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider">
  <providers>
    <clear />
    <add name="AspNetSqlRoleProvider" connectionStringName="DefaultConnection" applicationName="/" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
  </providers>
</roleManager>

In my web config. Which I did and it then allowed me to access the controller. But I noticed that it let me access the controller if I was in that role or not.

I am using Cookies Authentication for my project. So I think that I am getting confused between the different types of authentication.

public void ConfigureAuth(IAppBuilder app)
    {
        // Enable the application to use a cookie to store information for the signed in user
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            ExpireTimeSpan = TimeSpan.FromMinutes(5),
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login")
        });

So I need some advice on where to go from here:

I simply want to make use of the roles which is implemented by the default project, I have populated the database etc. I just cant get my filters working.

4

1 回答 1

2

我认为我对不同类型的身份验证感到困惑。

我同意。首先，身份验证与登录有关。一旦用户登录，他们就会被验证。

基于用户角色限制对控制器操作或其他资源的访问称为授权。很多时候，人们将这两个安全问题统称为auth。但是，在我看来，您已经实施了身份验证，并且在授权方面遇到了问题。

据我所知，您的 web.config 中的 roleManager 部分与您正在使用的 Microsoft.AspNet.Identity 不兼容。如果您在UserManager<T>某处设置了一个类，那么您应该使用 Microsoft.AspNet.Identity 角色系统，而不是旧的 roleManager。因此，从您的 web.config 中删除该部分。

听起来 Microsoft.AspNet.Identity 正在阻止基于角色的访问您的操作，因为其中的某些内容设置不正确。该库有自己的名为 RoleManager 的类，类似于用于管理角色的 UserManager。您没有在问题中提供足够的信息让任何人帮助您确定问题的确切原因。但是，如果您对 Microsoft.AspNet.Identity RoleManager 进行一些研究，那么您应该能够自己调试问题。祝你好运。

于 2014-02-10T13:12:17.990 回答