asp.net mvc3.0通过窗体进行用户的验证（基于角色）

一、首先在web.config文件中进行窗体验证的配置如下：

 <authentication mode="Forms">

      <forms loginUrl="~/Home/LogOn" timeout="2880" />

 </authentication>

这样的配置，表示，如果在某个action上面使用了Authorize的属性设置，而刚好用户没有进行登录，那么页面就会导向登录的界面进行登录。

二、建立用户信息类如下：

 public class User

    {

        public int ID { get; set; }

        [Display(Name = "姓名")]

        [Required(ErrorMessage = "姓名不能为空")]

        public string Name { get; set; }

        [DisplayName("密码")]

        [Required(ErrorMessage = "密码不能为空")]

        [DataType(DataType.Password)]

        public string Password { get; set; }

        /// <summary>

        /// 这个是表示是否永久在客户端保存用户名

        /// </summary>

        [DisplayName("记住我？")]

        public bool RememberMe { get; set; }

        public Roles Roles { get; set; }

    }

    /// <summary>

    /// 角色信息类（基于角色）

    /// </summary>

    public class Roles

    {

        public int ID { get; set; }

        public string Name { get; set; }

    }

三、逻辑接口

    public interface IUserBusiness

    {

        /// <summary>

        /// 根据用户名获取该用户的角色名

        /// </summary>

        /// <param name="userName">用户名</param>

        /// <returns></returns>

        Roles GetRoles(string userName);

        /// <summary>

        /// 获取通过验证后的用户名和密码

        /// </summary>

        /// <param name="userName">用户名</param>

        /// <param name="password">密码</param>

        /// <returns></returns>

        User GetByUserNamePassword(string userName, string password);

        /// <summary>

        /// 将通过验证的用户信息写入cookie中

        /// </summary>

        /// <param name="userName"></param>

        /// <param name="createPersistenCookie"></param>

        void SignIn(string userName, bool createPersistenCookie);

        /// <summary>

        /// 注销（删除cookie中用户的信息）

        /// </summary>

        void SignOut();

    }

四、实现接口

 public class UserBusiness : IUserBusiness

    {

        private static User[] userList = new User[] 

        { 

            new User(){ID=1,Name="张三",Password="123456",Roles= new Roles(){ID=101,Name="employee"}},

            new User(){ID=2,Name="李四",Password="123456",Roles=new Roles(){ID=102,Name="manager"}},

            new User(){ID=3,Name="admin",Password="admin",Roles=new Roles(){ID=103,Name="admin"}}

        };

        public Roles GetRoles(string userName)

        {

            return userList.

                Where(u => u.Name == userName).

                Select(o => o.Roles).

                FirstOrDefault();

        }

        public User GetByUserNamePassword(string userName, string password)

        {

            return userList.FirstOrDefault(u => u.Name == userName && u.Password == password);

        }

        public void SignIn(string userName, bool createPersistenCookie)

        {

            if (string.IsNullOrEmpty(userName)) throw new ArgumentException("值不能为空或者null", "userName");

            FormsAuthentication.SetAuthCookie(userName, createPersistenCookie);

        }

        public void SignOut()

        {

            FormsAuthentication.SignOut();

        }

    }

五、动作的设计

  public IUserBusiness UserBusiness { get; set; }

        protected override void Initialize(System.Web.Routing.RequestContext requestContext)

        {

            if (UserBusiness == null) { UserBusiness = new UserBusiness(); }

            base.Initialize(requestContext);

        }

        [Authorize]//这个表明只有经过验证的用户就能访问

        public ActionResult Index()

        {

            return View();

        }

        [Authorize(Roles="admin")]//这个权限更高，而且还必须是角色名为admin的才能访问

        public ActionResult ShowResult()

        {

            return View();

        }

六、最后

在之前我们加入了Roles也在业务逻辑里面添加了获取Role的方法，那么我们在什么时候来取得该用户的Role呢？

我觉得是在页面验证之后要授权时，该方法在全局的Global.asax中，我们需要委托该事件。

委托时我们再去根据当前用户获取角色，或者此时早已经将角色获取好了，只是加入到系统的Context之用。

 

public MvcApplication()

        {

            AuthorizeRequest += new EventHandler(MvcApplication_AuthorizeRequest);

        }

        void MvcApplication_AuthorizeRequest(object sender, EventArgs e)

        {

            IIdentity id = Context.User.Identity;

            if (id.IsAuthenticated)

            {

                var roles = new UserBusiness().GetRoles(id.Name);

                string[] roleList = new string[] { roles.Name};

                Context.User = new GenericPrincipal(id, roleList);

            }

        }