22

我尝试使用 MVC5 和 OWIN 身份验证为网站的 ApplicationUser 添加自定义属性。我已经阅读了https://stackoverflow.com/a/10524305/264607并且我喜欢它如何与基本控制器集成以轻松访问新属性。我的问题是,当我将 HTTPContext.Current.User 属性设置为我的新 IPrincipal 时,我得到一个空引用错误:

[NullReferenceException: Object reference not set to an instance of an object.]
   System.Web.Security.UrlAuthorizationModule.OnEnter(Object source, EventArgs eventArgs) +127
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +136
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +69

这是我的代码:

    protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        if (HttpContext.Current.User.Identity.IsAuthenticated)
        {
            userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()));

            ApplicationUser user = userManager.FindByName(HttpContext.Current.User.Identity.Name);

            PatientPortalPrincipal newUser = new PatientPortalPrincipal();
            newUser.BirthDate = user.BirthDate;
            newUser.InvitationCode = user.InvitationCode;
            newUser.PatientNumber = user.PatientNumber;

            //Claim cPatient = new Claim(typeof(PatientPortalPrincipal).ToString(), );

            HttpContext.Current.User = newUser;
        }
    }

public class PatientPortalPrincipal : ClaimsPrincipal, IPatientPortalPrincipal
{
    public PatientPortalPrincipal(ApplicationUser user)
    {
        Identity = new GenericIdentity(user.UserName);
        BirthDate = user.BirthDate;
        InvitationCode = user.InvitationCode;
    }

    public PatientPortalPrincipal() { }

    public new bool IsInRole(string role)
    {
        if(!string.IsNullOrWhiteSpace(role))
            return Role.ToString().Equals(role);

        return false;
    }

    public new IIdentity Identity { get; private set; }
    public WindowsBuiltInRole Role { get; set; }
    public DateTime BirthDate { get; set; }
    public string InvitationCode { get; set; }
    public string PatientNumber { get; set; }
}

public interface IPatientPortalPrincipal : IPrincipal
{

    WindowsBuiltInRole Role { get; set; }
    DateTime BirthDate { get; set; }
    string InvitationCode { get; set; }
    string PatientNumber { get; set; }
}

我没有找到太多关于如何做到这一点的文档,我已经阅读了这些文章:

http://blogs.msdn.com/b/webdev/archive/2013/10/16/customizing-profile-information-in-asp-net-identity-in-vs-2013-templates.aspx

http://blogs.msdn.com/b/webdev/archive/2013/07/03/understanding-owin-forms-authentication-in-mvc-5.aspx

第二个链接中的评论指出我可能使用声明(http://msdn.microsoft.com/en-us/library/ms734687.aspx?cs-save-lang=1&cs-lang=csharp),但文章链接to 没有显示如何将它们添加到IPrincipal(这是什么HttpContext.Current.User),或者您应该在管道中的哪个位置将它们添加到 a ClaimsIdentity(这是具体的类User)。我倾向于使用声明,但我需要知道在哪里向用户添加这些新声明。

即使索赔是要走的路,我也很好奇我的自定义 IPrincipal 做错了什么,因为我似乎已经实现了它所需的一切。

4

4 回答 4

18

我可以使用Claims基于安全性的方法来完成某些工作,因此,如果您希望快速完成某些工作,我目前拥有的就是:

AccountController(我的在SignInAsync方法内)的登录过程中,向由以下人员创建的身份添加新声明UserManager

private async Task SignInAsync(ApplicationUser user, bool isPersistent)
{
    AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
    var identity = await UserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
    identity.AddClaim(new Claim("PatientNumber", user.PatientNumber)); //This is what I added
    AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
}

然后在我的基本控制器类中,我简单地添加了一个属性:

private string _patientNumber;
public string PatientNumber
{
    get
    {
        if (string.IsNullOrWhiteSpace(_patientNumber))
        {
            try
            {
                var cp = ClaimsPrincipal.Current.Identities.First();
                var patientNumber = cp.Claims.First(c => c.Type == "PatientNumber").Value;
                _patientNumber = patientNumber;
            }
            catch (Exception)
            {
            }
        }
        return _patientNumber;
    }
}

此链接有助于了解索赔知识: http: //msdn.microsoft.com/en-us/library/ms734687.aspx ?cs-save-lang=1&cs-lang=csharp#code-snippet-1


IPrincipal 问题的更新

我追踪到了Identity物业。问题是我在PatientPortalPrincipal未设置 Identity 属性的类上提供了默认构造函数。我最终做的是删除默认构造函数并从内部调用正确的构造函数Application_PostAuthenticateRequest,更新的代码如下

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
{
    if (HttpContext.Current.User.Identity.IsAuthenticated)
    {
        userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()));

        ApplicationUser user = userManager.FindByName(HttpContext.Current.User.Identity.Name);

        PatientPortalPrincipal newUser = new PatientPortalPrincipal(user);
        newUser.BirthDate = user.BirthDate;
        newUser.InvitationCode = user.InvitationCode;
        newUser.PatientNumber = user.PatientNumber;

        //Claim cPatient = new Claim(typeof(PatientPortalPrincipal).ToString(), );

        HttpContext.Current.User = newUser;
    }
}

这使得整个事情工作!

于 2014-02-11T12:57:52.313 回答
5

您会遇到异常,因为HttpContext.Current.User.Identity.IsAuthenticated在检查时返回 false (也是如此HttpContext.Current.Request.IsAuthenticated)。

如果您删除该if (HttpContext.Current.User.Identity.IsAuthenticated)语句,它将正常工作(至少这部分代码)。

我尝试过这样一个简单的事情:

基本控制器.cs

public abstract class BaseController : Controller
{
    protected virtual new CustomPrincipal User
    {
        get { return HttpContext.User as CustomPrincipal; }
    }
}

CustomPrincipal.cs

public class CustomPrincipal : IPrincipal
{
    public IIdentity Identity { get; private set; }
    public bool IsInRole(string role) { return false; }

    public CustomPrincipal(string username)
    {
        this.Identity = new GenericIdentity(username);
    }

    public DateTime BirthDate { get; set; }
    public string InvitationCode { get; set; }
    public int PatientNumber { get; set; }
}

全球.asax.cs

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
{
     CustomPrincipal customUser = new CustomPrincipal(User.Identity.Name);

     customUser.BirthDate = DateTime.Now;
     customUser.InvitationCode = "1234567890A";
     customUser.PatientNumber = 100;

     HttpContext.Current.User = customUser;
}

家庭控制器.cs

public ActionResult Index()
{
    ViewBag.BirthDate = User.BirthDate;
    ViewBag.InvitationCode = User.InvitationCode;
    ViewBag.PatientNumber = User.PatientNumber;

    return View();
}

这工作正常。所以除非这段代码:

userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()));

ApplicationUser user = userManager.FindByName(HttpContext.Current.User.Identity.Name);

没有返回有效的(自定义)用户对象,问题出在if()语句上。

您的更新看起来不错,如果您愿意将数据作为声明存储在 cookie 中,您可以使用它,尽管我个人讨厌try {}那里的 catch 块。

我做的是这样的:

基本控制器.cs

[AuthorizeEx]
public abstract partial class BaseController : Controller
{
    public IOwinContext OwinContext
    {
        get { return HttpContext.GetOwinContext(); }
    }

    public new ClaimsPrincipal User
    {
        get { return base.User as ClaimsPrincipal; }
    }

    public WorkContext WorkContext { get; set; }
}

我用自定义属性装饰基本控制器类。

AuthorizeExAttribute.cs:

public class AuthorizeExAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        Ensure.Argument.NotNull(filterContext);

        base.OnAuthorization(filterContext);

        IPrincipal user = filterContext.HttpContext.User;
        if (user.Identity.IsAuthenticated)
        {
            var ctrl = filterContext.Controller as BaseController;
            ctrl.WorkContext = new WorkContext(user.Identity.Name);
        }
    }
}

和 WorkContext.cs:

public class WorkContext
{
    private string _email;

    private Lazy<User> currentUser;

    private IAuthenticationService authService;
    private ICacheManager cacheManager;

    public User CurrentUser
    {
        get 
        { 
            var cachedUser = cacheManager.Get<User>(Constants.CacheUserKeyPrefix + this._email);
            if (cachedUser != null)
            {
                return cachedUser;
            }
            else
            {
                var user = currentUser.Value;

                cacheManager.Set(Constants.CacheUserKeyPrefix + this._email, user, 30);

                return user;
            }
        }
    }

    public WorkContext(string email)
    {
        Ensure.Argument.NotNullOrEmpty(email);

        this._email = email;

        this.authService = DependencyResolver.Current.GetService<IAuthenticationService>();
        this.cacheManager = DependencyResolver.Current.GetService<ICacheManager>();

        this.currentUser = new Lazy<User>(() => authService.GetUserByEmail(email));
    }

然后我像这样访问 WorkContext:

public class DashboardController : BaseController
{
    public ActionResult Index()
    {
        ViewBag.User = WorkContext.CurrentUser;

        return View();
    }
}

我正在使用 Ninject 的 Dependency Resolver 进行解析authServicecacheManager但您可以跳过缓存并将 authService 替换为UserManager我相信的 ASP.NET Identity。

由于 WorkContext 类深受 NugetGallery 项目的启发,我还想在应得的地方给予赞扬。

于 2014-02-10T21:58:31.030 回答
3

我打赌HttpContext.Current.User为空。所以代替这个:

if (HttpContext.Current.User.Identity.IsAuthenticated)

你可以试试这个:

if (HttpContext.Current.Request.IsAuthenticated)
于 2014-02-10T21:23:13.243 回答
0

我有同样的错误。

我的问题是,对于匿名用户,我没有在 IPrincipal 上设置 IIdentity。我只在用户使用用户名登录时才这样做。否则,IIdentity 为空。

我的解决方案是始终设置 IIdentity。如果用户未通过身份验证(匿名用户),则 IIdentity.IsAuthenticated 设置为 false。否则为真。

我的代码:

private PrincipalCustom SetPrincipalIPAndBrowser()
{
     return new PrincipalCustom
     {
       IP = RequestHelper.GetIPFromCurrentRequest(HttpContext.Current.Request),
       Browser = RequestHelper.GetBrowserFromCurrentRequest(HttpContext.Current.Request),

    /* User is not authenticated, but Identity must be set anyway. If not, error occurs */
       Identity = new IdentityCustom { IsAuthenticated = false }
     };
}
于 2016-09-30T09:38:53.000 回答