[英]ASP.Net Identity 2 - Why doesn't my filter work?
我尝试创建一个简单的过滤器,以查看用户是否处于名为“系统管理员”的角色,这基本上是必须要做的[Authorize(Roles = "System Administrator")]
简写形式。 我以为这很简单,但是我对MVC还是很陌生,所以也许我忽略了一些东西。
这是我的代码:
using System.Web.Mvc;
namespace site_redesign_web.Filters
{
public class SystemAdminFilter : ActionFilterAttribute
{
string SysAdminRole = "System Administrator";
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
if (filterContext.RequestContext.HttpContext.User != null)
{
var userSysAdmin = filterContext.RequestContext.HttpContext.User.IsInRole(SysAdminRole) == true;
filterContext.ActionParameters["IsSysAdmin"] = userSysAdmin;
}
}
}
}
有人可以建议我要去哪里吗? 如果该人不是系统管理员,那么它将带他们到Home/NoPermissions
这是一个巨大的优势。
谢谢!
由于您正在处理授权,因此我将扩展AuthorizeAttribute
而不是一般模式的ActionFilterAttribute
。 您只需要覆盖一种方法HandleUnauthorizedRequest
,当授权失败时将执行该方法。 AuthorizeAttribute的默认实现已经为您处理了基于角色的授权。
public class SystemAdminAttribute : AuthorizeAttribute
{
private const string SysAdminRole = "System Administrator";
public SystemAdminFilter()
{
//this defines the role that will be used to authorize the user:
this.Roles = SysAdminRole;
}
//if user is not authorized redirect to "Home/NoPermissions" page
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
if(!filterContext.HttpContext.User.Identity.IsAuthenticated)
{
base.HandleUnauthorizedRequest(filterContext);
}
else
{
filterContext.Result = new RedirectToRouteResult(new
RouteValueDictionary(new { controller = "Home", action = "NoPermissions" }));
}
}
}
实现属性后,用它装饰相应的Controllers或Actions:
[SystemAdmin]
public SysAdminController : Controller
{
}
更新:解决所有问题。 AJ。 好了...终于解决了问题
using ActionFilterAttribute
using System.Web.Mvc;
namespace site_redesign_web.Filters
{
public class SystemAdminFilter : ActionFilterAttribute
{
string SysAdminRole = "System Administrator";
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
if (filterContext.RequestContext.HttpContext.User != null)
{
var userSysAdmin = filterContext.RequestContext.HttpContext.User.IsInRole(SysAdminRole) == true;
if(!userSysAdmin)
{
filterContext.Result = new RedirectToRouteResult(
new System.Web.Routing.RouteValueDictionary{
{"controller", "Home"},
{"action", "Index"}
});
}
}
}
}
}
并且您的控制器应为
[SystemAdminFilter] // at controller level
public SomeController : Controller
{
}
或者您也可以通过这样的注释将其用于特定的操作
public SomeController : Controller
{
[SystemAdminFilter] // at Action level
public ActionResult SomeAction()
{
// perform your actions
}
之所以可以使用,是因为我在Global.asax的Application_AuthorizeRequest中手动传递了他的用户角色
protected void Application_AuthorizeRequest(Object sender, EventArgs e)
{
FormsAuthenticationTicket formsAuthenticationTicket = new FormsAuthenticationTicket("Aravind", true, 30);
FormsIdentity formsIdentityId = new FormsIdentity(formsAuthenticationTicket);
GenericPrincipal genericPrincipal = new GenericPrincipal(formsIdentityId, new string[] { "SystemUser" }); //TEST with this redirected to Home Index place
HttpContext.Current.User = genericPrincipal ;
}
我的下一个测试是与此
GenericPrincipal genericPrincipal = new GenericPrincipal(formsIdentityId, new string[] { "System Administrator" }); //TEST with this did not perform an action
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.