ASP.NET自定义身份验证/授权

Question

I need to authorize my user through external service no identity no owin no katana is required. Only based on Boolean value true or false. Which is send by api. How can i ovveride [Authorize] attribute to suite my needs?

public class LoginController {


  public ActionResult LoginThroughExternalApp(authModel model)  
  {

   bool isUserExist = externalApp.isUserExist(model.userName, model.Password);

   if(isUserExist)
   {
        return RedirecToAction("DefaultActionName","DefaultController");
   }

     return RedirectToAction("Redirect to error login page.");
  }
}  



    [Authorize]
    public class DefaultController 
    {
      public ActionResult DefaultAction() 
      {
         //Do some stuff
      }
    }

Answer 1

You can define CustomActionAttribute to add any method with specific parameter(s). Then you can do custom operation to let user.

[AttributeUsage(AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public class CustomActionAttribute : FilterAttribute, IActionFilter, IResultFilter
{
    public string ParamName { get; set; }

    public void OnActionExecuted(ActionExecutedContext filterContext)
    {
        throw new NotImplementedException();
    }

    public void OnActionExecuting(ActionExecutingContext filterContext)
    {

        if (filterContext.ActionParameters.ContainsKey(ParamName))
        {
            try
            {
                var model = filterContext.ActionParameters[ParamName] as authModel;
                bool isUserExist = externalApp.isUserExist(model.userName, model.Password);
                if (isUserExist)
                    // this code let you to go on without checking authorization.
                    return;
            }
            catch
            {
            }
        }
        filterContext.Result = new ViewResult
        {
            ViewName = "~/Views/Shared/UnAuthorizeAction.cshtml",
        };

    }

    public void OnResultExecuted(ResultExecutedContext filterContext)
    {
        throw new NotImplementedException();
    }

    public void OnResultExecuting(ResultExecutingContext filterContext)
    {
        throw new NotImplementedException();
    }
}

And here it's usage:

[CustomActionAttribute(IdParamName = model)]
public ActionResult DefaultAction(authModel model)
{
    //...
}