在MVC上设置用户角色

Question

I need some help, I am making a role based menu. I'm using LDAP Active Directory to log In.

I can log in but I cannot get the roles from the groups of AD.

I try to use a role provider but cant get it to work. I get the groups using:

private ArrayList setRoles()
{
    ArrayList rolesList = new ArrayList();
    DirectoryEntry de = new DirectoryEntry("LDAP://**********");
    DirectorySearcher ds = new DirectorySearcher(de);
    ds.PropertiesToLoad.Add("memberOf");
    ds.SearchScope = SearchScope.Subtree;
    ds.Filter = "(sAMAccountName=test)"; // your username

    SearchResult result = ds.FindOne();

    foreach (string g in result.Properties["memberOf"])
        rolesList.Add(g);
    return rolesList;
}

Now, I need to "set" the roles somewhere in order to use

User.IsInRole("Admin")

and

[Authorize role...]
public bla bla bla()

Any ideas, links, etc?

PD: IM USING FORMS AUTH.

Answer 1

You shouldn't have to manually do this. Using the built in role provider should accomplish the task by setting it in the web.config.

Active Directory Membership Provider

Windows Token Role Provider

UPDATE: Here's a question on StackOverflow that covers setting this up with an ActiveDirectory membership provider but still using Forms Authentication.

ASP.NET MVC - Authenticate users against Active Directory, but require username and password to be inputted

Answer 2

I do not have experience working with AD, however, what you need to do is set the User property of HttpContext with a Principal that has the roles.

An approach I have previously created was to create a custom authorization attribute that inherits from AuthorizationAttribute.

public class AuthorizeActiveDirectoryAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        var user = filterContext.HttpContext.User;

        //Your code to get the list of roles for the current user

        var formsIdentity = filterContext.HttpContext.User.Identity as FormsIdentity;
        filterContext.HttpContext.User = new System.Security.Principal.GenericPrincipal(formsIdentity, rolesList.ToArray());

        base.OnAuthorization(filterContext);
    }

}

You would then apply it to your action methods

[AuthorizeActiveDirectory role...]
public bla bla bla()

This will also allow you to use User.IsInRole("Admin")