ASP.NET WebForms项目角色配置及用户角色分配求助

1. 配置角色管理器 #

首先在项目启动配置中注册RoleManager，确保Owin能提供角色管理服务。找到项目中的Startup.Auth.cs（若没有，可在Global.asax的Application_Start中配置，推荐使用Owin Startup类），添加以下配置：

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Microsoft.Owin;
using Microsoft.Owin.Security.Cookies;
using Owin;

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        // 已有的用户管理器配置
        app.CreatePerOwinContext(ApplicationUserManager.Create);
        // 添加角色管理器配置
        app.CreatePerOwinContext<ApplicationRoleManager>(ApplicationRoleManager.Create);

        // Cookie认证配置
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            }
        });
    }
}

创建ApplicationRoleManager类（可放在App_Start或Models文件夹下）：

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.EntityFramework;
using Microsoft.AspNet.Identity.Owin;
using Microsoft.Owin;

public class ApplicationRoleManager : RoleManager<IdentityRole>
{
    public ApplicationRoleManager(IRoleStore<IdentityRole, string> roleStore)
        : base(roleStore)
    {
    }

    public static ApplicationRoleManager Create(IdentityFactoryOptions<ApplicationRoleManager> options, IOwinContext context)
    {
        var manager = new ApplicationRoleManager(new RoleStore<IdentityRole>(context.Get<ApplicationDbContext>()));
        return manager;
    }
}

2. 初始化常用角色 #

在用户分配角色前，需确保目标角色已存在。可在Global.asax的Application_Start中添加初始化逻辑：

protected void Application_Start(object sender, EventArgs e)
{
    CreateRolesIfNotExists();
}

private void CreateRolesIfNotExists()
{
    using (var context = new ApplicationDbContext())
    {
        var roleManager = new RoleManager<IdentityRole>(new RoleStore<IdentityRole>(context));

        // 创建Admin角色
        if (!roleManager.RoleExists("Admin"))
        {
            var role = new IdentityRole("Admin");
            roleManager.Create(role);
        }

        // 创建普通用户角色
        if (!roleManager.RoleExists("User"))
        {
            var role = new IdentityRole("User");
            roleManager.Create(role);
        }
    }
}

3. 修改用户创建代码，添加角色分配 #

在你现有的CreateUser_Click方法中，用户创建成功后添加角色分配逻辑：

protected void CreateUser_Click(object sender, EventArgs e)
{
    var manager = Context.GetOwinContext().GetUserManager<ApplicationUserManager>();
    var roleManager = Context.GetOwinContext().Get<ApplicationRoleManager>(); // 获取角色管理器
    var signInManager = Context.GetOwinContext().Get<ApplicationSignInManager>();
    var user = new ApplicationUser() { UserName = Email.Text, Email = Email.Text, FirstName = FirstName.Text, LastName = LastName.Text };
    IdentityResult result = manager.Create(user, Password.Text);
    if (result.Succeeded)
    {
        // 分配默认角色，可根据需求修改为"Admin"或其他角色
        var roleResult = manager.AddToRole(user.Id, "User");
        if (!roleResult.Succeeded)
        {
            ErrorMessage.Text = roleResult.Errors.FirstOrDefault();
            return; // 角色分配失败则终止后续流程
        }

        string code = manager.GenerateEmailConfirmationToken(user.Id);
        string callbackUrl = IdentityHelper.GetUserConfirmationRedirectUrl(code, user.Id, Request);
        manager.SendEmail(user.Id, "Confirm your account", "Please confirm your account by clicking <a href=\"" + callbackUrl + "\">here</a>.");

        signInManager.SignIn(user, isPersistent: false, rememberBrowser: false);

        IdentityHelper.RedirectToReturnUrl(Request.QueryString["ReturnUrl"], Response);
    }
    else 
    {
        ErrorMessage.Text = result.Errors.FirstOrDefault();
    }
}

4. 页面中验证角色 #

方式1：使用LoginView控件 #

<asp:LoginView runat="server">
    <AnonymousTemplate>
        <p>请登录访问内容</p>
    </AnonymousTemplate>
    <RoleGroups>
        <asp:RoleGroup Roles="Admin">
            <ContentTemplate>
                <p>欢迎管理员！<asp:HyperLink runat="server" NavigateUrl="~/Admin/ManageUsers.aspx">管理用户</asp:HyperLink></p>
            </ContentTemplate>
        </asp:RoleGroup>
        <asp:RoleGroup Roles="User">
            <ContentTemplate>
                <p>欢迎普通用户！</p>
            </ContentTemplate>
        </asp:RoleGroup>
    </RoleGroups>
</asp:LoginView>

方式2：后台代码验证 #

protected void Page_Load(object sender, EventArgs e)
{
    AdminPanel.Visible = User.IsInRole("Admin");
}

方式3：页面级授权（在@Page指令中） #

<%@ Page Title="Admin Page" Language="C#" MasterPageFile="~/Site.Master" AutoEventWireup="true" CodeBehind="ManageUsers.aspx.cs" Inherits="YourProject.Admin.ManageUsers" Roles="Admin" %>

内容的提问来源于stack exchange，提问作者AM_MA