在.NET Core 5中如何为角色动态分配声明并关联用户？

1. 基础配置（Identity与EF Core） #

默认ASP.NET Core Identity已提供IdentityRoleClaim实体存储角色与声明的关联，只需确保DbContext正确集成Identity：

public class AppDbContext : IdentityDbContext<IdentityUser>
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options)
    {
    }
}

在Startup.cs中配置Identity与数据库连接，同时启用角色支持：

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<AppDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

    services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
        .AddRoles<IdentityRole>() // 启用角色管理功能
        .AddEntityFrameworkStores<AppDbContext>();

    services.AddControllersWithViews();
    services.AddRazorPages();
}

2. 动态创建角色并分配声明 #

通过RoleManager<IdentityRole>实现角色创建与声明分配，可在程序初始化时执行该逻辑：

public static async Task InitializeRolesAsync(IServiceProvider serviceProvider)
{
    var roleManager = serviceProvider.GetRequiredService<RoleManager<IdentityRole>>();

    // 定义角色对应的权限声明集合
    var roleClaimsMap = new Dictionary<string, List<string>>
    {
        { "Moderator", new List<string> { "CanViewPosts", "CanEditPosts" } }
    };

    foreach (var entry in roleClaimsMap)
    {
        var roleName = entry.Key;
        var claims = entry.Value;

        // 检查角色是否已存在
        if (!await roleManager.RoleExistsAsync(roleName))
        {
            var role = new IdentityRole(roleName);
            await roleManager.CreateAsync(role);

            // 为角色逐个添加声明
            foreach (var claim in claims)
            {
                await roleManager.AddClaimAsync(role, new Claim(claim, "true"));
            }
        }
    }
}

3. 创建用户并分配角色 #

结合UserManager<IdentityUser>完成用户创建与角色分配，可放在初始化逻辑中：

public static async Task InitializeModeratorUserAsync(IServiceProvider serviceProvider)
{
    var userManager = serviceProvider.GetRequiredService<UserManager<IdentityUser>>();
    const string moderatorEmail = "moderator@example.com";
    const string password = "ModeratorPass123!";

    var existingUser = await userManager.FindByEmailAsync(moderatorEmail);
    if (existingUser == null)
    {
        var user = new IdentityUser
        {
            UserName = moderatorEmail,
            Email = moderatorEmail,
            EmailConfirmed = true
        };

        var createResult = await userManager.CreateAsync(user, password);
        if (createResult.Succeeded)
        {
            await userManager.AddToRoleAsync(user, "Moderator");
        }
    }
}

4. 初始化逻辑调用 #

在Program.cs主方法中调用初始化方法，确保程序启动时完成角色与用户配置：

public static async Task Main(string[] args)
{
    var host = CreateHostBuilder(args).Build();

    using (var scope = host.Services.CreateScope())
    {
        var services = scope.ServiceProvider;
        try
        {
            await InitializeRolesAsync(services);
            await InitializeModeratorUserAsync(services);
        }
        catch (Exception ex)
        {
            var logger = services.GetRequiredService<ILogger<Program>>();
            logger.LogError(ex, "初始化角色或用户时发生错误");
        }
    }

    await host.RunAsync();
}

5. 验证声明的使用 #

控制器中用特性限制访问

[Authorize]
public class PostsController : Controller
{
    [Authorize("CanViewPosts")]
    public IActionResult Index()
    {
        return View();
    }

    [Authorize("CanEditPosts")]
    public IActionResult Edit(int id)
    {
        return View();
    }
}

代码中手动检查声明

if (User.HasClaim("CanEditPosts", "true"))
{
    // 执行编辑操作逻辑
}

内容的提问来源于stack exchange，提问作者Mehedi Hasan Kajol