ASP.Net 身份 2 - 为什么我的过滤器不起作用？

Question

我试着创建一个简单的过滤器，看看用户是否处于一个名为"系统管理员"的角色，基本上是必须做[Authorize(Roles = "System Administrator")]的简写。我认为这将是相当简单的，但我也相当新的MVC，所以也许我忽略了一些东西。

下面是我的代码:

using System.Web.Mvc;
namespace site_redesign_web.Filters
{
    public class SystemAdminFilter : ActionFilterAttribute
    {
        string SysAdminRole = "System Administrator";
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext.RequestContext.HttpContext.User != null)
            {
                var userSysAdmin = filterContext.RequestContext.HttpContext.User.IsInRole(SysAdminRole) == true;
                filterContext.ActionParameters["IsSysAdmin"] = userSysAdmin;
            }
        }
    }
}

谁能告诉我哪里做错了吗?如果这个人不是系统管理员，它将引导他们到Home/NoPermissions。

谢谢!

Answer 1

更新:修复所有问题。AJ。给你……最终修复了问题

using ActionFilterAttribute 
using System.Web.Mvc;
namespace site_redesign_web.Filters
{
    public class SystemAdminFilter : ActionFilterAttribute
    {
        string SysAdminRole = "System Administrator";
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext.RequestContext.HttpContext.User != null)
            {
                var userSysAdmin = filterContext.RequestContext.HttpContext.User.IsInRole(SysAdminRole) == true;
            if(!userSysAdmin)
            {
                filterContext.Result = new RedirectToRouteResult(
                    new System.Web.Routing.RouteValueDictionary{
                    {"controller", "Home"},     
                    {"action", "Index"}
                });
            }
            }
        }
    }
}

和控制器应该是

[SystemAdminFilter]     // at controller level
public SomeController : Controller
{
}

或者您也可以将它用于特定的操作，通过如下注释

public SomeController : Controller
{
    [SystemAdminFilter]     // at Action level
    public ActionResult SomeAction()
    {
            // perform your actions
    }

它将工作，因为我在Global.asax

中的Application_AuthorizeRequest中手动传递了User及其角色。

protected void Application_AuthorizeRequest(Object sender, EventArgs e)
{
     FormsAuthenticationTicket formsAuthenticationTicket = new FormsAuthenticationTicket("Aravind", true, 30);
     FormsIdentity formsIdentityId = new FormsIdentity(formsAuthenticationTicket);
     GenericPrincipal genericPrincipal = new GenericPrincipal(formsIdentityId, new string[] { "SystemUser" }); //TEST with this redirected to Home Index place
     HttpContext.Current.User = genericPrincipal ;
}

我做的下一个测试是这个

GenericPrincipal genericPrincipal = new GenericPrincipal(formsIdentityId, new string[] { "System Administrator" }); //TEST with this did not perform an action

Answer 2

由于您正在处理授权，我将扩展AuthorizeAttribute而不是ActionFilterAttribute，这是模式一般。您只需要覆盖一个方法—HandleUnauthorizedRequest，它在授权失败时执行。AuthorizeAttribute的默认实现已经为您处理基于角色的授权。

public class SystemAdminAttribute : AuthorizeAttribute
{
    private const string SysAdminRole = "System Administrator";
    public SystemAdminFilter()
    {   
        //this defines the role that will be used to authorize the user:
        this.Roles = SysAdminRole;
    }  
    //if user is not authorized redirect to "Home/NoPermissions" page
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if(!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            base.HandleUnauthorizedRequest(filterContext);
        }
        else
        {
            filterContext.Result = new RedirectToRouteResult(new
               RouteValueDictionary(new { controller = "Home", action = "NoPermissions" }));
         }
     }           
}

一旦你的属性被实现，用它装饰相应的控制器或动作:

[SystemAdmin]
public SysAdminController : Controller
{
}