ASP.NET MVC5中使用Identity登录后为用户关联角色的方法

Hey there, let's walk through how to handle role association in ASP.NET MVC5's Identity system—since it's built to handle this out of the box, it's a bit cleaner than your old MVC4 custom Forms Auth setup.

First, let's recap your MVC4 code: you were manually decrypting the auth cookie, pulling the username, fetching roles from the DB, and constructing a GenericPrincipal. In MVC5 Identity, most of this heavy lifting is handled by the framework, but let's cover the key steps to make sure roles are properly linked after login.

1. Ensure Your Identity Setup Supports Roles #

First, confirm your project is configured to work with Identity roles. If you created the project with "Individual User Accounts", this is already set up, but double-check:

• Your ApplicationDbContext should inherit from IdentityDbContext<ApplicationUser> (this includes default role support)
• If you need custom role properties, create an ApplicationRole class that inherits from IdentityRole; otherwise, the default IdentityRole works fine.

2. Assign Roles to Users (Pre-Login) #

Before users log in, you need to make sure their roles are assigned in the database. You can do this during registration, or via an admin interface:

// Example: Assign a role during user registration
var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
var createResult = await UserManager.CreateAsync(user, model.Password);
if (createResult.Succeeded)
{
    // Add the user to the "member" role
    await UserManager.AddToRoleAsync(user.Id, "member");
    // Proceed with login logic...
}

3. Login with Automatic Role Claims #

When using Identity's built-in login flow, it automatically includes the user's roles as claims in the authentication cookie. Here's a typical login action:

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
    if (!ModelState.IsValid)
    {
        return View(model);
    }

    // Verify user credentials
    var user = await UserManager.FindAsync(model.UserName, model.Password);
    if (user != null)
    {
        // Create an identity with the user's roles included
        var authIdentity = await UserManager.CreateIdentityAsync(
            user, 
            DefaultAuthenticationTypes.ApplicationCookie
        );

        // Optional: Add custom claims here if needed
        // authIdentity.AddClaim(new Claim("CustomPermission", "EditPosts"));

        // Sign in the user—roles are already embedded in the identity
        AuthenticationManager.SignIn(
            new AuthenticationProperties { IsPersistent = model.RememberMe }, 
            authIdentity
        );
        return RedirectToLocal(returnUrl);
    }

    ModelState.AddModelError("", "Invalid username or password.");
    return View(model);
}

How This Replaces Your MVC4 Code #

In your old MVC4 setup, you had to manually extract roles and build a GenericPrincipal. In MVC5 Identity:

• UserManager.CreateIdentityAsync automatically fetches the user's roles from the database and adds them as ClaimTypes.Role claims
• AuthenticationManager.SignIn stores these claims in the auth cookie
• For subsequent requests, the OWIN middleware automatically reconstructs the ClaimsPrincipal with all role claims. This means User.IsInRole("admin") or the [Authorize(Roles="members, admin")] attribute works out of the box—no need for the FormsAuthentication_OnAuthenticate event handler!

4. Verify Roles Are Working #

To confirm roles are properly associated, you can check in any action or view:

// In a controller action
if (User.IsInRole("admin"))
{
    // Execute admin-only logic
}

// In a Razor view
@if (User.IsInRole("member"))
{
    <div class="member-only-content">Welcome, registered member!</div>
}

That's the core of it. Identity takes care of most of the manual work you had to do in MVC4. The key steps are assigning roles to users upfront, and letting the built-in Identity methods handle creating the authenticated principal with role claims.

内容的提问来源于stack exchange，提问作者Mist