構建ASP.NET MVC中的自定義授權

Question

在DB中我有Role和User實體具有一對多關係。

我想要做的是構建自定義授權過濾器。我見過的所有教程都使用默認的ASP.NET成員資格。我所知道的是我需要繼承AuthorizationAttribute，但不知道我需要覆蓋哪些方法以及如何實現它們。

public class UserAuth : AuthorizeAttribute 
{ 

} 

在DB：

角色

public class Role 
{ 
    [Key] 
    public int RoleID { get; set; } 

    [Required] 
    public int RolenameValue { get; set; } 

    [MaxLength(100)] 
    public string Description { get; set; } 

    // // // // // 

    public Rolename Rolename 
    { 
     get { return (ProjectName.Domain.Enums.Rolename)RolenameValue; } 
     set { RolenameValue = (int)value; } 
    } 

    public virtual ICollection<User> Users { get; set; } 
} 

用戶

public class User 
{ 
    [Key] 
    public int UserID { get; set; } 

    [Required] 
    [MaxLength(30)] 
    public string Username { get; set; } 

    [Required] 
    [MinLength(5)] 
    public string Password { get; set; } 

    [Required] 
    [DataType(DataType.EmailAddress)] 
    public string Email { get; set; } 

    [MaxLength(30)] 
    public string FirstName { get; set; } 

    [MaxLength(50)] 
    public string LastName { get; set; } 

    [DataType(DataType.Date)] 
    public DateTime Birthdate { get; set; } 

    public int GenderValue { get; set; } 

    // // // // // // // 

    public Gender Gender 
    { 
     get { return (ProjectName.Domain.Enums.Gender)GenderValue; } 
     set { GenderValue = (int)value; } 
    } 

    public int RoleID { get; set; } 

    [ForeignKey("RoleID")] 
    public Role Role { get; set; } 

Answer 1

你並不需要創建一個自定義屬性。你可以使用現有的AuthoriseAttribute，但你應該做的是實現定製Principal類，它將使用你自己的DB角色。在你Principal類，你將實現IsInRole方法：

public bool IsInRole(string role) 
{ 
    if(this.Roles == null) 
     this.Roles = DependencyResolver.Current 
      .GetService<ISecurityService>() 
      .GetUserPermissions(this.Identity.Name); 

    return this.Roles.Any(p => p.Name == role); 
} 

你應該設置你的自定義Principal在Global.asax中

void OnPostAuthenticateRequest(object sender, EventArgs e) 
    { 
     // Get a reference to the current User 
     IPrincipal user = HttpContext.Current.User; 

     // If we are dealing with an authenticated forms authentication request   
     if (user.Identity.IsAuthenticated && user.Identity.AuthenticationType == "Forms") 
     { 
      // Create custom Principal 
      var principal = new MyCustomPrincipal(user.Identity); 

      // Attach the Principal to HttpContext.User and Thread.CurrentPrincipal 
      HttpContext.Current.User = principal; 
      System.Threading.Thread.CurrentPrincipal = principal; 
     } 
    }