ASP.NET MVC 5:自定义身份验证 [英] ASP.NET MVC 5: Custom Authentication

问题描述

在我的ASP.NET MVC 5应用程序中，我需要使用自定义身份验证.基本上是一个自定义库，我在该库上调用方法，并返回一个包含有关用户信息的对象.

In my ASP.NET MVC 5 application I need to use custom Authentication. Basically a custom library on which I call a method and which returns an object that contains information about the user.

我创建了一个新的MVC 5应用程序，并选择了无身份验证"选项.然后，我添加了一个Http模块，该模块当前如下所示:

I've created a new MVC 5 application and selected the "No Authentication" option. Then I've added an Http Module which currently looks like this:

private void Context_AuthenticateRequest(object sender, EventArgs e)
{
    // Make the call to authenticate.
    // This returns an object with user information.
    AuthResult result = new AuthLib().SignOn();

    // Inspect the returned object and create a list claims.
    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.NameIdentifier, result.Username),
        new Claim(ClaimTypes.GivenName, result.Name)
    }
    claims.AddRange(result.Groups.Select(g => new Claim(ClaimType.Role, g));

    // Create principal and attach to context
    var principal = new ClaimsPrincipal(new ClaimsIdentity(claims, "Sso");
    HttpContext.Current.User = principal;
    Thread.CurrentPrincipal = principal;
}

private void Context_PostAuthenticateRequest(object sender, EventArgs e)
{
    var principal = ClaimsPrincipal.Current;
    ClaimsAuthenticationManager transformer = FederatedAuthentication.SessionAuthenticationModule.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager;
    transformer.Authenticate(string.Empty, principal);
}

我的Claimstransformer看起来像这样:

My claimstransformer looks like this:

public override ClaimsPrincipal Authenticate(string resourceName, ClaimsPrincipal incomingPrincipal)
{
    if (!incomingPrincipal.Identity.IsAuthenticated)
    {
        return base.Authenticate(resourceName, incomingPrincipal);
    }

    ClaimsPrincipal newPrincipal = CreateApplicationPrincipal(incomingPrincipal);

    EstablishSession(newPrincipal);

    return newPrincipal;
}

private void EstablishSession(ClaimsPrincipal newPrincipal)
{
    var sessionToken = new SessionSecurityToken(newPrincipal, TimeSpan.FromHours(8));
    FederatedAuthentication.SessionAuthenticationModule.WriteSessionTokenToCookie(sessionToken);
}

private ClaimsPrincipal CreateApplicationPrincipal(ClaimsPrincipal incomingPrincipal)
{
    // Convert AD group to known role in our application.
    string group = incomingPrincipal.FindFirst(ClaimTypes.Role).Value;
    string role = new ADGroupToRoleConverter().ConvertADGroupToRole(group);

    // Add claims for group.
    // These would be loaded from a db.
    List<Claim> claims = new ClaimDb().GetClaimsForRole(role);

    // Just copy the claims for id and given name.
    claims.Add(incomingPrincipal.FindFirst(ClaimTypes.NameIdentifier));
    claims.Add(incomingPrincipal.FindFirst(ClaimTypes.GivenName));

    return new ClaimsPrincipal(new ClaimsIdentity(claims, "MyApp"));
}

我面临的主要问题是，即使存在会话，也会为每个请求调用身份验证步骤.如何检测到会话存在，而只是加载该会话，而不是执行整个身份验证过程.

The main issue that I'm facing is that the authentication step is called for every request even though a session exists. How can I detect that a session exists and just load the session instead of going through the entire authentication process.

另一个问题是对身份验证库的调用可能需要一段时间.我想理想情况下也应该将其移至索赔转换器?

Another issue is that the call to the authentication library might take a while. I guess ideally it should also be moved to the claims transformer?

任何进一步改进此代码的想法也将受到赞赏.

Any ideas to improve this code further are also very much appreciated.

如果有不清楚的地方或者需要提供更详细的信息，请告诉我.

Please let me know if something is not clear or if I need to provide more detailed information.

推荐答案

在我看来，您在身份验证后没有为每个请求提供身份验证信息.身份验证发生后，您能否验证每个请求都发送了一些会话cookie或身份验证标头?

It seems to me that you do not provide authentication information with each request after the authentication. Can you verify that you have some session cookie or authentication header sent with each request after the authentication happens?

这篇关于ASP.NET MVC 5:自定义身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！