.NET 4.x下ASP.NET MVC项目角色权限实现方法咨询

针对你的场景，只需要扩展IIdentity和IPrincipal，并在请求生命周期中替换默认的主体对象，就能让[Authorize]特性和User.IsInRole()方法生效，具体步骤如下：

1. 自定义Identity类 #

创建实现IIdentity的自定义类，用来存储用户名和角色信息：

public class CustomIdentity : IIdentity
{
    public CustomIdentity(string name, string[] roles)
    {
        Name = name;
        Roles = roles;
    }

    public string AuthenticationType => "Forms";
    public bool IsAuthenticated => !string.IsNullOrEmpty(Name);
    public string Name { get; }
    public string[] Roles { get; }
}

2. 自定义Principal类 #

实现IPrincipal接口，关联自定义Identity并实现角色判断逻辑：

public class CustomPrincipal : IPrincipal
{
    public CustomPrincipal(CustomIdentity identity)
    {
        Identity = identity;
    }

    public IIdentity Identity { get; }

    public bool IsInRole(string role)
    {
        // 忽略大小写判断角色是否存在
        return ((CustomIdentity)Identity).Roles.Contains(role, StringComparer.OrdinalIgnoreCase);
    }
}

3. 替换请求的Principal对象 #

在Global.asax.cs中重写Application_PostAuthenticateRequest事件，解密Forms认证票据，解析角色并替换当前上下文的Principal：

protected void Application_PostAuthenticateRequest(object sender, EventArgs e)
{
    var authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
    if (authCookie == null) return;

    try
    {
        var ticket = FormsAuthentication.Decrypt(authCookie.Value);
        if (ticket == null || ticket.Expired) return;

        // 从UserData解析角色（假设存储的是逗号分隔的字符串，比如"admins,users"）
        var roles = ticket.UserData.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries);
        var identity = new CustomIdentity(ticket.Name, roles);
        var principal = new CustomPrincipal(identity);

        // 更新上下文和线程的Principal
        Context.User = principal;
        System.Threading.Thread.CurrentPrincipal = principal;
    }
    catch
    {
        // 处理票据解密失败的情况，清除无效cookie并重定向到登录页
        FormsAuthentication.SignOut();
        Response.Redirect("~/Account/Login");
    }
}

4. 登录时存储角色到票据的UserData #

在登录逻辑中，将用户角色以逗号分隔的字符串存入Forms认证票据的UserData字段：

[HttpPost]
public ActionResult Login(LoginModel model)
{
    // 自定义用户验证逻辑（替换为你自己的用户校验代码）
    bool isValidUser = ValidateUserCredentials(model.UserName, model.Password);
    if (!isValidUser)
    {
        ModelState.AddModelError("", "用户名或密码错误");
        return View(model);
    }

    // 获取当前用户的角色（替换为你从自定义数据源获取角色的逻辑）
    string[] userRoles = GetUserRoles(model.UserName);
    string rolesString = string.Join(",", userRoles);

    // 创建Forms认证票据
    var authTicket = new FormsAuthenticationTicket(
        version: 1,
        name: model.UserName,
        issueDate: DateTime.Now,
        expiration: DateTime.Now.AddMinutes(30),
        isPersistent: model.RememberMe,
        userData: rolesString,
        cookiePath: FormsAuthentication.FormsCookiePath);

    // 加密票据并写入Cookie
    string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
    var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
    {
        HttpOnly = true,
        Secure = FormsAuthentication.RequireSSL,
        Expires = model.RememberMe ? authTicket.Expiration : DateTime.MinValue
    };

    Response.Cookies.Add(authCookie);
    return RedirectToAction("Index", "Home");
}

// 示例辅助方法，需替换为实际逻辑
private bool ValidateUserCredentials(string userName, string password)
{
    // 这里写你的用户验证逻辑，比如从数据库/配置文件校验
    return userName == "admin" && password == "123456";
}

private string[] GetUserRoles(string userName)
{
    // 这里写你的角色获取逻辑，比如根据用户名返回对应的角色数组
    return userName == "admin" ? new[] { "admins", "users" } : new[] { "users" };
}

验证功能 #

完成以上步骤后，你就可以正常使用：

• 在控制器/动作上添加[Authorize(Roles = "admins")]特性限制访问
• 在代码或视图中调用User.IsInRole("admins")判断用户角色

内容的提问来源于stack exchange，提问作者Jean-Pierre R