ASP.NET 6 MVC Identity 注册用户自动分配默认角色异常

使用集成Identity组件的ASP.NET 6 MVC框架开发，系统设置三类角色，需要实现用户注册时自动分配默认User角色的功能。

现有实现代码未生效：核查数据库发现Identity.AspNetUsers表、Identity.Roles表均正常更新，但存储用户角色关联关系的Identity.UserRoles表未写入对应数据。

public class RegisterModel : PageModel
{
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly IUserStore<ApplicationUser> _userStore;
    private readonly IUserEmailStore<ApplicationUser> _emailStore;
    private readonly ILogger<RegisterModel> _logger;
    private readonly IEmailSender _emailSender;

    private readonly RoleManager<IdentityRole> _roleManager;

    public RegisterModel(
        UserManager<ApplicationUser> userManager,
        IUserStore<ApplicationUser> userStore,
        SignInManager<ApplicationUser> signInManager,
        ILogger<RegisterModel> logger,
        IEmailSender emailSender,
        //Added this
        RoleManager<IdentityRole> roleManager)
    {
        _userManager = userManager;
        _userStore = userStore;
        _emailStore = GetEmailStore();
        _signInManager = signInManager;
        _logger = logger;
        _emailSender = emailSender;
        //Added this
        _roleManager = roleManager;
    }

    [BindProperty]
    public InputModel Input { get; set; }

    public string ReturnUrl { get; set; }

    public IList<AuthenticationScheme> ExternalLogins { get; set; }

    public class InputModel
    {
        [Required]
        [EmailAddress]
        [Display(Name = "Email")]
        public string Email { get; set; }

        [Required]
        [StringLength(100, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.", MinimumLength = 6)]
        [DataType(DataType.Password)]
        [Display(Name = "Password")]
        public string Password { get; set; }

        [DataType(DataType.Password)]
        [Display(Name = "Confirm password")]
        [Compare("Password", ErrorMessage = "The password and confirmation password do not match.")]
        public string ConfirmPassword { get; set; }
    }

    public async Task OnGetAsync(string returnUrl = null)
    {
        ReturnUrl = returnUrl;
        ExternalLogins = (await _signInManager.GetExternalAuthenticationSchemesAsync()).ToList();
    }

    public async Task<IActionResult> OnPostAsync(string returnUrl = null)
    {
        returnUrl ??= Url.Content("~/");
        ExternalLogins = (await _signInManager.GetExternalAuthenticationSchemesAsync()).ToList();
        if (ModelState.IsValid)
        {
            var user = CreateUser();

            await _userStore.SetUserNameAsync(user, Input.Email, CancellationToken.None);
            await _emailStore.SetEmailAsync(user, Input.Email, CancellationToken.None);

            var result = await _userManager.CreateAsync(user, Input.Password);

            if (result.Succeeded)
            {
                _logger.LogInformation("User created a new account with password.");


                //Added this
                var defaultrole = _roleManager.FindByNameAsync("User").Result;
                //Added this
                if (defaultrole != null)
                {
                    IdentityResult roleresult = await _userManager.AddToRoleAsync(user, "User");
                }

                var userId = await _userManager.GetUserIdAsync(user);
                var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
                code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
                var callbackUrl = Url.Page(
                    "/Account/ConfirmEmail",
                    pageHandler: null,
                    values: new { area = "Identity", userId = userId, code = code, returnUrl = returnUrl },
                    protocol: Request.Scheme);

                await _emailSender.SendEmailAsync(Input.Email, "Confirm your email",
                    $"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>clicking here</a>.");

                if (_userManager.Options.SignIn.RequireConfirmedAccount)
                {
                    return RedirectToPage("RegisterConfirmation", new { email = Input.Email, returnUrl = returnUrl });
                }
                else
                {
                    await _signInManager.SignInAsync(user, isPersistent: false);
                    return LocalRedirect(returnUrl);
                }
            }
            foreach (var error in result.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
        }

        // If we got this far, something failed, redisplay form
        return Page();
    }

    private ApplicationUser CreateUser()
    {
        try
        {
            return Activator.CreateInstance<ApplicationUser>();
        }
        catch
        {
            throw new InvalidOperationException($"Can't create an instance of '{nameof(ApplicationUser)}'. " +
                $"Ensure that '{nameof(ApplicationUser)}' is not an abstract class and has a parameterless constructor, or alternatively " +
                $"override the register page in /Areas/Identity/Pages/Account/Register.cshtml");
        }
    }

    private IUserEmailStore<ApplicationUser> GetEmailStore()
    {
        if (!_userManager.SupportsUserEmail)
        {
            throw new NotSupportedException("The default UI requires a user store with email support.");
        }
        return (IUserEmailStore<ApplicationUser>)_userStore;
    }
}

参考教程提到需要“为支持的角色创建枚举，在Enums/Roles路径下添加新枚举”，不清楚该枚举的放置方式，是否需要新建独立类文件？虽然后续更换其他教程未使用该枚举，但仍希望了解该部分的正确实现方式，对应枚举代码如下：

public enum Roles
{
    Admin,
    User
}

角色分配不生效的修复 #

代码存在两个核心问题导致UserRoles表没有写入数据：

1. 异步方法调用混用.Result造成上下文阻塞：_roleManager.FindByNameAsync("User").Result是同步阻塞写法，在ASP.NET请求上下文中极易出现线程死锁，导致后续AddToRoleAsync操作实际没有执行完成。
2. 没有对AddToRoleAsync的返回结果做校验和错误处理，操作失败也没有日志或提示，无法定位具体错误。

修正后的角色分配代码段如下：

if (result.Succeeded)
{
    _logger.LogInformation("User created a new account with password.");

    // 全程使用await异步调用，禁止用.Result阻塞
    var defaultRole = await _roleManager.FindByNameAsync("User");
    if (defaultRole != null)
    {
        var roleResult = await _userManager.AddToRoleAsync(user, "User");
        // 校验角色分配结果，失败时记录日志、返回提示
        if (!roleResult.Succeeded)
        {
            foreach (var err in roleResult.Errors)
            {
                _logger.LogError($"分配默认角色失败：{err.Description}");
                ModelState.AddModelError(string.Empty, $"角色分配失败：{err.Description}");
            }
            // 角色分配为必填逻辑时，可删除刚创建的用户后返回错误页
            return Page();
        }
    }
    else
    {
        _logger.LogError("默认User角色不存在于系统角色表中");
        ModelState.AddModelError(string.Empty, "系统默认角色配置异常，请联系管理员");
        return Page();
    }

    // 后续发送确认邮件、登录逻辑保持不变
    var userId = await _userManager.GetUserIdAsync(user);
    // ... 原有剩余代码
}

额外必查配置项：确认Program.cs中已经正确添加Identity角色服务，不能遗漏AddRoles<IdentityRole>()配置，正确配置参考如下：

builder.Services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddRoles<IdentityRole>() // 这行必须添加，否则所有角色相关操作都不会生效
    .AddEntityFrameworkStores<ApplicationDbContext>();

如果之前没加这行配置，添加完成后需要重新生成迁移、更新数据库，避免表结构不匹配。

Roles枚举的正确实现方式 #

这个枚举不是Identity的强制要求，属于编码最佳实践，作用是硬编码角色名、避免代码中到处写容易拼错的魔法字符串：

1. 放置方式：在项目根目录新建Enums文件夹，在文件夹内新建独立类文件Roles.cs，把枚举代码放入即可，注意命名空间和项目全局命名空间匹配。
2. 用法：后续代码中不需要硬写"User"、"Admin"字符串，直接用Roles.User.ToString()、Roles.Admin.ToString()即可，从根源避免拼写错误导致的角色匹配失败。比如上述角色分配代码可以改写为：

var defaultRole = await _roleManager.FindByNameAsync(Roles.User.ToString());
if (defaultRole != null)
{
    var roleResult = await _userManager.AddToRoleAsync(user, Roles.User.ToString());
}

系统初始化种子角色时，也可以直接遍历这个枚举批量创建，不需要重复手写角色名。

内容的提问来源于stack exchange，提问作者qwerty