asp.netcore 设置两个登录路径

Question

I'm beging width asp.net core, and want set two login path for authorization:'/account/login' for users and '/Admin/Account/Login' for administrators,that 'Admin' is an area name,but don't know what's wrong width me. here is my code in startup.cs:

public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthorization();
        ...
    }

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    ...
    app.UseCookieAuthentication(new CookieAuthenticationOptions()
    {
        AuthenticationScheme = "UserAuthScheme",
        AutomaticAuthenticate = true,
        AutomaticChallenge = true,
        CookieName = ".AUTOUSERAUTHCOOKIE",
        LoginPath = "/Account/Login",
        CookieHttpOnly = true
    });
    app.UseCookieAuthentication(new CookieAuthenticationOptions()
    {
        AuthenticationScheme = "AdministratorAuthScheme",
        AutomaticAuthenticate = true,
        AutomaticChallenge = true,
        CookieName = ".AUTOADMINAUTHCOOKIE",
        LoginPath = "/Admin/Account/Login",
        CookieHttpOnly = true
    });
    ...
}

AdministratorController.cs:

[Authorize(Roles ="Super",ActiveAuthenticationSchemes ="AdministratorAuthScheme")]
public async Task<IActionResult> Edit(string id)
{
    if (string.IsNullOrEmpty(id))
    {
        return new EmptyResult();
    }
    .....
}

when user does not have an "Super" role,it just jump to "/Account/AccessDenied?ReturnUrl=%2FAdmin%2FAdministrator%2FEdit".

roles: user is for general user,"Admin" is for administrator,"super" is for Super Administrator which can modify or create administrator. Can any one help me or give a reference link? and i'm sorry for my poor english :)

Answer 1

Use OnApplyRedirect Action to customize the logic.

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/account/login"),
    Provider = new CookieAuthenticationProvider
    {
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager)),
        OnApplyRedirect = ctx =>
        {
            if (ctx.Request.Path.StartsWithSegments(new PathString("/admin")))
                ctx.Response.Redirect("/admin/account/login?ReturnUrl=" + HttpUtility.UrlEncode(ctx.Request.Path.ToString()));
            else
                ctx.Response.Redirect(ctx.RedirectUri);
        }
    },
});

Answer 2

i don't think so you can do that with this way, the best way is to do Custom Authorization attribute then check for role or url and redirect user as you want

Example

public class CustomAuthorizeAttribute : ControllerAttribute, IAsyncActionFilter
{
    public bool IsAdmin { get; set; } = false;
    public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
    {
        var resultContext = await next();
        bool hasAllowAnonymous = resultContext.ActionDescriptor.EndpointMetadata.Any(em => em.GetType() == typeof(AllowAnonymousAttribute));
        bool isAuth = resultContext.HttpContext.User.Identity.IsAuthenticated;

        if (!isAuth && !hasAllowAnonymous)
        {
            string redirectUrl = resultContext.HttpContext.Request.Path.Value;

            if (IsAdmin)
                resultContext.Result = new RedirectToActionResult("Index", "About", new { redirectUrl = redirectUrl, area = "Admin" });
            else
                resultContext.Result = new RedirectToActionResult("App", "Home", new { redirectUrl = redirectUrl });
        }
    }
}