如何在 ASP.NET MVC 5 中实现自定义身份验证 [英] How to implement custom authentication in ASP.NET MVC 5
问题描述
我正在开发一个 ASP.NET MVC 5 应用程序.我有一个现有的数据库,我从中创建了我的 ADO.NET 实体数据模型.我在那个数据库中有一个包含用户名"和密码"列的表,我想用它们在我的 Webapp 中实现身份验证和授权;由于客户的要求,我无法创建任何其他数据库或表或列,也无法使用标准身份验证.我不需要管理注册、密码更改或其他事情:只需使用密码和用户名登录.我怎样才能做到这一点?
I'm developing an ASP.NET MVC 5 application. I have an existing DB, from which I created my ADO.NET Entity Data Model. I have a table in that DB which contains "username" and "password" column, and I want to use them to implement authentication and authorization in my Webapp; I cannot create any other database or table or column and I cannot use the standard Identity authentication, because of customer's requirements. I don't need to manage signup, password changing or other stuffs: just login with password and username. How can I do that?
推荐答案
是的,你可以.认证和授权部分独立工作.如果您有自己的身份验证服务,则可以使用 OWIN 的授权部分.假设您已经有一个 UserManager
来验证 username
和 password
.因此,您可以在回发登录操作中编写以下代码:
Yes, you can. Authentication and Authorization parts work independently. If you have your own authentication service you can just use OWIN's authorization part. Consider you already have a UserManager
which validates username
and password
. Therefore you can write the following code in your post back login action:
[HttpPost]
public ActionResult Login(string username, string password)
{
if (new UserManager().IsValid(username, password))
{
var ident = new ClaimsIdentity(
new[] {
// adding following 2 claim just for supporting default antiforgery provider
new Claim(ClaimTypes.NameIdentifier, username),
new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity", "http://www.w3.org/2001/XMLSchema#string"),
new Claim(ClaimTypes.Name,username),
// optionally you could add roles if any
new Claim(ClaimTypes.Role, "RoleName"),
new Claim(ClaimTypes.Role, "AnotherRole"),
},
DefaultAuthenticationTypes.ApplicationCookie);
HttpContext.GetOwinContext().Authentication.SignIn(
new AuthenticationProperties { IsPersistent = false }, ident);
return RedirectToAction("MyAction"); // auth succeed
}
// invalid username or password
ModelState.AddModelError("", "invalid username or password");
return View();
}
你的用户经理可以是这样的:
And your user manager can be something like this:
class UserManager
{
public bool IsValid(string username, string password)
{
using(var db=new MyDbContext()) // use your DbConext
{
// for the sake of simplicity I use plain text passwords
// in real world hashing and salting techniques must be implemented
return db.Users.Any(u=>u.Username==username
&& u.Password==password);
}
}
}
最后,您可以通过添加 Authorize
属性来保护您的操作或控制器.
In the end, you can protect your actions or controllers by adding an Authorize
attribute.
[Authorize]
public ActionResult MySecretAction()
{
// all authorized users can use this method
// we have accessed current user principal by calling also
// HttpContext.User
}
[Authorize(Roles="Admin")]
public ActionResult MySecretAction()
{
// just Admin users have access to this method
}
这篇关于如何在 ASP.NET MVC 5 中实现自定义身份验证的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!