[英]How do I use ASP.NET Identity 2.0 to allow a user to impersonate another user?
我正在將一個ASP.NET MVC 5.1應用程序從MembershipProvider遷移到ASP.NET Identity v2.0。 我在應用程序中的一個功能是用戶模擬:管理員可以在網站上注冊的任何其他用戶登錄,而無需知道密碼。
我使用此代碼實現MembershipProvider的用戶模擬 ,這不適用於Identity庫。
如何在ASP.NET標識中實現用戶模擬(而不是IIS模擬)?
我找到了解決這個問題的方法。
基本上我用admin用戶名添加聲明,如果這個聲明存在,我知道假冒正在發生。 當管理員想要停止模擬時,系統會檢索聲明的原始用戶名,刪除舊的模擬cookie並為管理員創建新的Cookie:
[AuthenticateAdmin] // <- make sure this endpoint is only available to admins
public async Task ImpersonateUserAsync(string userName)
{
var context = HttpContext.Current;
var originalUsername = context.User.Identity.Name;
var impersonatedUser = await userManager.FindByNameAsync(userName);
var impersonatedIdentity = await userManager.CreateIdentityAsync(impersonatedUser, DefaultAuthenticationTypes.ApplicationCookie);
impersonatedIdentity.AddClaim(new Claim("UserImpersonation", "true"));
impersonatedIdentity.AddClaim(new Claim("OriginalUsername", originalUsername));
var authenticationManager = context.GetOwinContext().Authentication;
authenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
authenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = false }, impersonatedIdentity);
}
更多信息在我的博客文章中: 用戶模仿ASP.Net Identity 2 。
更新2017年7月:這個主題非常受歡迎,所以我研究了Core中的用戶模仿,原理與更新的API非常相似。 以下是如何冒充:
[Authorize(Roles = "Admin")] // <-- Make sure only admins can access this
public async Task<IActionResult> ImpersonateUser(String userId)
{
var currentUserId = User.GetUserId();
var impersonatedUser = await _userManager.FindByIdAsync(userId);
var userPrincipal = await _signInManager.CreateUserPrincipalAsync(impersonatedUser);
userPrincipal.Identities.First().AddClaim(new Claim("OriginalUserId", currentUserId));
userPrincipal.Identities.First().AddClaim(new Claim("IsImpersonating", "true"));
// sign out the current user
await _signInManager.SignOutAsync();
// If you use asp.net core 1.0
await HttpContext.Authentication.SignInAsync(cookieOptions.ApplicationCookieAuthenticationScheme, userPrincipal);
// If you use asp.net core 2.0 (the line above is deprecated)
await HttpContext.SignInAsync(cookieOptions.ApplicationCookieAuthenticationScheme, userPrincipal);
return RedirectToAction("Index", "Home");
}
這是如何停止冒充:
[Authorize(Roles = "Admin")] // <-- Make sure only admins can access this
public async Task<IActionResult> StopImpersonation()
{
if (!User.IsImpersonating())
{
throw new Exception("You are not impersonating now. Can't stop impersonation");
}
var originalUserId = User.FindFirst("OriginalUserId").Value;
var originalUser = await _userManager.FindByIdAsync(originalUserId);
await _signInManager.SignOutAsync();
await _signInManager.SignInAsync(originalUser, isPersistent: true);
return RedirectToAction("Index", "Home");
}
我的博客中有完整的解釋: http : //tech.trailmax.info/2017/07/user-impersonation-in-asp-net-core/ GitHub上的完整代碼示例: https : //github.com/trailmax/AspNetCoreImpersonation
僅針對誰使用Asp Net Core Identity,這是解決初始問題的代碼(管理員想要以用戶身份輸入,而不知道密碼)。 以下解決方案不是帶有令牌的真實“模擬”,如投票答案中所示:
[Authorize("Administrator")]
public async Task<IActionResult> ImpersonateUserAsync(string email)
{
var impersonatedUser = await _userManager.FindByNameAsync(email); //Usually username is the email
await _signInManager.SignOutAsync(); //signout admin
await _signInManager.SignInAsync(impersonatedUser,false); //Impersonate User
return RedirectToAction("Index","Home");
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.