如何在ASP.NET Core 2.0中兼容ASP.NET 2.0认证数据库结构？

当然可以！虽然ASP.NET Core已经不再直接支持SqlMembershipProvider（这是基于System.Web的旧组件），但你完全可以通过自定义身份验证逻辑来兼容旧数据库的结构。下面是具体的实现步骤，我帮你拆解清楚：

首先，你需要创建与旧SqlMembership数据库表对应的实体类，映射那些核心表（比如aspnet_Users、aspnet_Membership、aspnet_Roles、aspnet_UsersInRole）的字段：

public class AspnetUser
{
    public Guid ApplicationId { get; set; }
    public Guid UserId { get; set; }
    public string UserName { get; set; }
    public string LoweredUserName { get; set; }
    public DateTime LastActivityDate { get; set; }
    // 其他字段按需添加，比如MobileAlias、IsAnonymous等
}

public class AspnetMembership
{
    public Guid UserId { get; set; }
    public string Password { get; set; }
    public string PasswordSalt { get; set; }
    public string Email { get; set; }
    public int PasswordFormat { get; set; } // 0=明文, 1=哈希, 2=加密
    public int FailedPasswordAttemptCount { get; set; }
    // 其他字段按需添加
}

public class AspnetRole
{
    public Guid ApplicationId { get; set; }
    public Guid RoleId { get; set; }
    public string RoleName { get; set; }
}

public class AspnetUsersInRole
{
    public Guid UserId { get; set; }
    public Guid RoleId { get; set; }
}

你可以用EF Core做ORM映射，或者用更轻量的Dapper直接写SQL查询，根据自己的习惯选择就行。

SqlMembershipProvider的密码存储有特定规则，默认是密码+盐拼接后做SHA1哈希（如果是哈希模式，对应PasswordFormat=1）；如果是加密模式（PasswordFormat=2），则需要用旧系统的machineKey配置来解密。先给你哈希模式的验证代码：

private bool ValidateHashedPassword(string providedPassword, string storedPassword, string passwordSalt)
{
    // 把盐和密码转成字节数组
    var saltBytes = Convert.FromBase64String(passwordSalt);
    var passwordBytes = Encoding.Unicode.GetBytes(providedPassword);
    
    // 拼接盐和密码字节
    var combinedBytes = new byte[saltBytes.Length + passwordBytes.Length];
    Buffer.BlockCopy(saltBytes, 0, combinedBytes, 0, saltBytes.Length);
    Buffer.BlockCopy(passwordBytes, 0, combinedBytes, saltBytes.Length, passwordBytes.Length);
    
    // 用SHA1计算哈希（旧系统默认算法，若旧系统配置了MD5则换成MD5.Create()）
    using var sha1 = SHA1.Create();
    var hashedBytes = sha1.ComputeHash(combinedBytes);
    var hashedPassword = Convert.ToBase64String(hashedBytes);
    
    // 对比存储的哈希值
    return hashedPassword == storedPassword;
}

如果旧系统用的是加密模式，你需要拿到旧系统web.config里的machineKey配置（validationKey、decryptionKey、decryption算法），然后手动实现解密逻辑——这部分稍微复杂，需要还原System.Web.MachineKey的加密逻辑，你可以参考旧版的实现思路来写。

接下来写一个服务类，封装用户验证、角色查询的逻辑：

public class LegacyMembershipService
{
    private readonly IDbConnection _dbConnection;
    private readonly Guid _applicationId; // 旧数据库对应的应用ID，从配置里取

    public LegacyMembershipService(IDbConnection dbConnection, IConfiguration config)
    {
        _dbConnection = dbConnection;
        _applicationId = Guid.Parse(config["LegacyMembership:ApplicationId"]);
    }

    public async Task<ClaimsPrincipal> ValidateUserAsync(string userName, string password)
    {
        // 查询用户（注意过滤ApplicationId，避免跨应用数据）
        var user = await _dbConnection.QueryFirstOrDefaultAsync<AspnetUser>(
            @"SELECT * FROM aspnet_Users 
              WHERE UserName = @UserName AND ApplicationId = @ApplicationId",
            new { UserName = userName, ApplicationId = _applicationId });

        if (user == null)
            return null;

        // 查询会员信息
        var membership = await _dbConnection.QueryFirstOrDefaultAsync<AspnetMembership>(
            "SELECT * FROM aspnet_Membership WHERE UserId = @UserId",
            new { UserId = user.UserId });

        if (membership == null)
            return null;

        // 验证密码
        bool isPasswordValid = false;
        switch (membership.PasswordFormat)
        {
            case 0: // 明文
                isPasswordValid = password == membership.Password;
                break;
            case 1: // 哈希
                isPasswordValid = ValidateHashedPassword(password, membership.Password, membership.PasswordSalt);
                break;
            case 2: // 加密
                // 这里添加解密验证逻辑，需要用到旧系统的machineKey
                isPasswordValid = ValidateEncryptedPassword(password, membership.Password, membership.PasswordSalt);
                break;
        }

        if (!isPasswordValid)
            return null;

        // 查询用户角色
        var roles = await _dbConnection.QueryAsync<string>(
            @"SELECT r.RoleName FROM aspnet_Roles r 
              JOIN aspnet_UsersInRole ur ON r.RoleId = ur.RoleId
              WHERE ur.UserId = @UserId AND r.ApplicationId = @ApplicationId",
            new { UserId = user.UserId, ApplicationId = _applicationId });

        // 创建ClaimsPrincipal，用于后续身份验证
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.UserId.ToString()),
            new Claim(ClaimTypes.Name, user.UserName),
            new Claim(ClaimTypes.Email, membership.Email)
        };

        foreach (var role in roles)
        {
            claims.Add(new Claim(ClaimTypes.Role, role));
        }

        var identity = new ClaimsIdentity(claims, "LegacyMembership");
        return new ClaimsPrincipal(identity);
    }

    // 加密模式的密码验证方法，按需实现
    private bool ValidateEncryptedPassword(string providedPassword, string storedPassword, string passwordSalt)
    {
        // 这里需要用旧系统的machineKey解密存储的密码，然后和输入密码对比
        // 参考旧版MachineKey.Unprotect的逻辑，用对应的算法（比如TripleDES）解密
        throw new NotImplementedException("需要实现加密密码的验证逻辑");
    }
}

然后在Startup.cs里注册这个服务和数据库连接：

public void ConfigureServices(IServiceCollection services)
{
    // 注册数据库连接（比如SQL Server）
    services.AddScoped<IDbConnection>(sp => 
        new SqlConnection(Configuration.GetConnectionString("LegacyMembershipDb")));

    // 注册自定义会员服务
    services.AddScoped<LegacyMembershipService>();

    // 如果要用JWT验证，添加JWT服务
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = Configuration["Jwt:Issuer"],
                ValidAudience = Configuration["Jwt:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Secret"]))
            };
        });
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ...其他中间件
    app.UseAuthentication();
    app.UseAuthorization();
    // ...其他中间件
}

最后写一个登录的API接口，调用自定义服务完成验证，比如：

[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase
{
    private readonly LegacyMembershipService _membershipService;
    private readonly IConfiguration _configuration;

    public AuthController(LegacyMembershipService membershipService, IConfiguration configuration)
    {
        _membershipService = membershipService;
        _configuration = configuration;
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequest request)
    {
        var principal = await _membershipService.ValidateUserAsync(request.UserName, request.Password);
        if (principal == null)
            return Unauthorized("用户名或密码错误");

        // 生成JWT令牌（如果用JWT的话）
        var tokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.UTF8.GetBytes(_configuration["Jwt:Secret"]);
        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = principal.Identity as ClaimsIdentity,
            Expires = DateTime.UtcNow.AddDays(7),
            Issuer = _configuration["Jwt:Issuer"],
            Audience = _configuration["Jwt:Audience"],
            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
        };
        var token = tokenHandler.CreateToken(tokenDescriptor);
        var tokenString = tokenHandler.WriteToken(token);

        return Ok(new { AccessToken = tokenString });
    }
}

public class LoginRequest
{
    public string UserName { get; set; }
    public string Password { get; set; }
}

• ApplicationId：旧SqlMembership用ApplicationId区分不同应用，一定要确保查询时过滤这个ID，避免拿到其他应用的用户数据。
• 密码加密兼容：如果旧系统是加密模式，必须拿到旧系统的machineKey配置才能解密，不然无法验证密码。
• 长期迁移建议：这种兼容方案只是过渡，长期来看建议把用户数据逐步迁移到ASP.NET Core Identity的结构，这样可以利用Core内置的身份验证、授权功能，减少维护成本。
• 性能优化：给旧数据库的常用查询字段（比如UserName、UserId）添加索引，提升查询速度。

内容的提问来源于stack exchange，提问作者Jeroen