ASP.NET身份数据库第一个自定义用户和角色

Question

We are trying to implement a Web API project with OWIN and .Net Identity for authentication. We have custom database tables for user and roles, so we need to take database first approach for EF.

I have managed to get the Identity to work with our custom account tables (thanks to other stackoverflow threads) but I am stuck on getting roles to work...

In summary what I have done so far is implemented a custom IUserStore with the following function

public class IdentityUserStore<TUser> : 
    IUserStore<TUser>, where TUser : IdentityUser
{

    ....

    public Task<TUser> FindByNameAsync(string userName)
    {
        //throw new NotImplementedException();
        IdentityUser user = null;

        Account result = _accountRepo.GetByEmail(userName);

        if (result != null)
        {
            user = new IdentityUser()
            {
                Id = result.Code,
                UserName = result.Email,
                SecurityStamp = result.SecurityStamp,
                PasswordHash = result.PasswordHash,
            };
        }

        return Task.FromResult<TUser>(user as TUser);
    }

    ....
}

** Note the Account entity did not inherit IUser so I had to manually map the minimal data required for IdentityUser.

And then override GrantResourceOwnerCredentials function as follows

public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{

        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

        UserManager<IdentityUser> _userManager = new UserManager<IdentityUser>(new IdentityUserStore<IdentityUser>());
        IdentityUser user = await _userManager.FindAsync(context.UserName, context.Password);

        if (user == null)
        {
            context.SetError("invalid_grant", "The user name or password is incorrect.");
            return;
        }

        var identity = new ClaimsIdentity(context.Options.AuthenticationType);
        identity.AddClaim(new Claim("sub", context.UserName));
        identity.AddClaim(new Claim("role", "user"));

        context.Validated(identity);

}

With the above the [Authorize] attribute works, but we cant get [Authorize(Roles="XXX")] because the role information is not available.

Can anyone please help point me to the right direction on retrieving user roles from custom database tables so it works with the .Net Identity framework?

Thanks!

Answer 1

The problem with the code above is that you add a role with an unknown (at least for the system) claim type. For roles the predefined claim-type is http://schemas.microsoft.com/ws/2008/06/identity/claims/role or System.Security.Claims.ClaimTypes.Role . So please change your code to

identity.AddClaim(new Claim("sub", context.UserName));
identity.AddClaim(new Claim(ClaimTypes.Role, "user"));