ASP.NET MVC5 提示 Windows Auth 忽略身份验证模式

Question

I gave up implementing Windows and Forms Authentication mode in the same project, I've encountered infinite login loops, authorization errors and nightmare-ish spaghetti code.

I'm keeping Forms authentication / RoleProvider just as-is but my idea it's triggering Windows authentication inside the HttpPost for the ActionResult Login , so the user would enter their domain username, press login button, then compare the text input against HttpContext identity, if true prompt Windows Authentication and if the login is successfull then redirect to admin/user corresponding webpages (getting the role from a SQL table).

This is a vague idea i pseudo coded.

[HttpPost]
public ActionResult Login (usuario u, string retornaUrl) {
    string userDomWin = System.Web.HttpContext.Current.Request.LogonUserIdentity.Name.ToString ().Substring ((HttpContext.User.Identity.Name.ToString ().IndexOf ("\\")) + 1);
    string userWin = userDomWin.Replace ("DOMAIN\\", "");

    var usuarioSys = (from d in db.usuario where d.usuarioDom == userWin select d.usuarioDom).FirstOrDefault ();

    if (usuarioSys != null) {
        //TRIGGER WINDOWS AUTH

        if (WINDOWSAUTH == true) {

            Session["uname"] = usuarioSys.ToString ();

            if (usuarioSys != null) {
                return Redirect ("~/Home/Index");
            } else {
                TempData["Message"] = "FINISHED.";
                return Redirect ("~/Account/Login");
            }
        } else {
            TempData["Message"] = "UNAUTOHRIZED.";
            return Redirect ("~/Account/Login");
        }

    }

    return View ();
}

Can you implement something equivalent?

Answer 1

your problem might be more complex than that, but from what you posted, it is normal that your users are redirected to the login page even after validating all your login (SQL & windows), as you did not add the form cookie to the response. If that is the source of the problem, here is my code for the return of the form cookie (encrypted)

            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                   2,
                   userName,
                   DateTime.Now,
                   DateTime.Now.AddMinutes(480),
                   true,
                   role,
                   FormsAuthentication.FormsCookiePath);

            string encTicket = FormsAuthentication.Encrypt(ticket);
            var response = System.Web.HttpContext.Current.Response;
            response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
            return RedirectToAction("Index", "Home");

hope it helps

Answer 2

I'm not sure how your project's web config is set up, but be sure to check if you have the authentication mode set to forms

<system.web>
    <authentication mode="Forms">  
       <forms loginUrl="Home/Login"></forms>  
    </authentication>  

As for why MVC authentication/authorization is difficult to set up / often has issues, there was a very useful thread that clarified that for me.

Personally, at least for internal applications, I prefer to use windows authentication via setting up my own function to check against Active Directory groups on the Domain where the app is deployed. The reason for this is, for internal apps, usually the "current user" is identified by whatever unique employee ID they are logged in as, so it is easier for the app to check against authorized active directory groups to see if they should / shouldn't access it.