方法上的多个授权属性 [英] Multiple Authorization attributes on method

问题描述

我无法指定两个独立的授权属性的一类方法：用户被允许访问如果两个属性是正确的。

I'm having trouble specifying two separate Authorization attributes on a class method: the user is to be allowed access if either of the two attributes are true.

该Athorization类看起来是这样的：

The Athorization class looks like this:

[AttributeUsage(AttributeTargets.All, AllowMultiple = true)]
public class AuthAttribute : AuthorizeAttribute {
. . .

和动作：

[Auth(Roles = AuthRole.SuperAdministrator)]
[Auth(Roles = AuthRole.Administrator, Module = ModuleID.SomeModule)]
public ActionResult Index() {
    return View(GetIndexViewModel());
}

有没有办法解决这个还是我需要重新考虑我的做法的一种方式？

Is there a way to solve this or do I need to rethink my approach?

这是在MVC2中运行。

This is to be run in MVC2.

推荐答案

多个 AuthorizeAttribute 实例由MVC处理，如同他们与加盟及。如果你想要一个或行为，你将需要实现自己的逻辑进行检查。 preferably实施 AuthAttribute 采取多种角色，并与或逻辑。

Multiple AuthorizeAttribute instances are processed by MVC as if they were joined with AND. If you want an OR behaviour you will need to implement your own logic for checks. Preferably implement AuthAttribute to take multiple roles and perform an own check with OR logic.

另一种解决方案是使用标准的 AuthorizeAttribute 并实现自定义的的IPrincipal 将实施布尔IsInRole（字符串角色）方法来提供'OR'的行为。

Another solution is to use standard AuthorizeAttribute and implement custom IPrincipal that will implement bool IsInRole(string role) method to provide 'OR' behaviour.

一个例子是在这里：
http://stackoverflow.com/a/10754108/449906

这篇关于方法上的多个授权属性的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！