没有ASP.NET身份的OWIN Cookie身份验证
问题描述:
我是ASP.NET MVC 5的新手,我发现身份验证+授权框架非常不舒服。我知道这是ASP.NET MVC框架的一个新特性,所以我想要应用另一种方式在应用程序中实现身份验证。没有ASP.NET身份的OWIN Cookie身份验证
可能吗?我读了我可以使用FormsAuthenticationModule
。这是一个很好的选择吗?我如何在基于MVC 5的应用程序中使用它?
答
当我看一下Identity时,我有同样的感觉。它增加了很多不必要的抽象,并且不适合我的情况,我拥有实现定制认证工作流程的遗留系统。
这里有大量关于默认使用Identity和EF的OWIN身份验证的示例,这使得开发人员感到困惑,OWIN必须使用Identity和Entity Framework。
但从技术上讲,您只能删除身份以仅使用OWIN Cookie身份验证(Microsoft.Owin.Security.Cookies
)。该代码就非常简单,下面是例子,我从我的代码得到消除琐碎的事情:
[HttpPost]
public ActionResult Login(LoginViewModel model, string returnUrl)
{
var user = _userService.GetByEmail(model.Email);
//check username and password from database, naive checking:
//password should be in SHA
if (user != null && (user.Password == model.Password))
{
var claims = new[] {
new Claim(ClaimTypes.Name, user.Name),
new Claim(ClaimTypes.Email, user.Email),
// can add more claims
};
var identity = new ClaimsIdentity(claims, "ApplicationCookie");
// Add roles into claims
var roles = _roleService.GetByUserId(user.Id);
if (roles.Any())
{
var roleClaims = roles.Select(r => new Claim(ClaimTypes.Role, r.Name));
identity.AddClaims(roleClaims);
}
var context = Request.GetOwinContext();
var authManager = context.Authentication;
authManager.SignIn(new AuthenticationProperties
{ IsPersistent = model.RememberMe }, identity);
return RedirectToAction("Index", "Home");
}
// login failed.
}
public ActionResult LogOut()
{
var ctx = Request.GetOwinContext();
var authManager = ctx.Authentication;
authManager.SignOut("ApplicationCookie");
return RedirectToAction("Login");
}
答
不使用Owin安全方法: 伊茨我的控制器编码
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Login(Employee emp, string returnUrl)
{
using(AdaptiveProjectEntities db = new AdaptiveProjectEntities())
{
string email = emp.Email;
// byte[] en = System.Text.Encoding.UTF8.GetBytes(emp.Password);
//var ee = Convert.ToBase64String(en);
string pass = emp.Password;
bool userValid = db.Employees.Any(user => user.Email == email && user.Password == pass);
if(userValid)
{
FormsAuthentication.SetAuthCookie(email, false);
if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
&& !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
{
return Redirect(returnUrl);
}
else
{
return RedirectToAction("Index", "Projects");
}
}
else
{
ModelState.AddModelError("", "The user name or password provided is incorrect.");
}
}
return View(emp);
}
public ActionResult Logout()
{
FormsAuthentication.SignOut();
return RedirectToAction("Login", "Login");
}
}
}
查看:
<div class="container" style="margin-right:50%">
<div class="row">
<div class="col-md-12 col-md-offset-7" style="bottom:-250px">
<div class="panel panel-default" style="margin-right:15%">
<div class="panel-heading" style="padding-bottom:5%">
<center><h3 style="margin-right:80px">Login</h3></center>
@*</div>*@
@using (Html.BeginForm())
{
<div class="modal-body">
@Html.AntiForgeryToken()
<div class="form-horizontal" style="margin-right: 10%;">
@Html.ValidationSummary(true, "", new { @class = "text-danger" })
<div class="form-group">
@Html.LabelFor(model => model.Email, htmlAttributes: new { @class = "control-label col-md-3" })
<div class="col-md-9">
@Html.EditorFor(model => model.Email, new { htmlAttributes = new { @class = "form-control", type = "email", required = "required" } })
@Html.ValidationMessageFor(model => model.Email, "", new { @class = "text-danger" })
</div>
</div>
<div class="form-group">
@Html.LabelFor(model => model.Password, htmlAttributes: new { @class = "control-label col-md-3" })
<div class="col-md-9">
@Html.EditorFor(model => model.Password, new { htmlAttributes = new { @class = "form-control", type = "password", required = "required" } })
@Html.ValidationMessageFor(model => model.Password, "", new { @class = "text-danger" })
</div>
</div>
</div>
<div>
<input class="btn btn-primary pull-left col-lg-offset-1" type="submit" value="Login" style="margin-left:35%" />
</div>
</div>
}
</div>
</div>
</div>
</div>
</div>
</div>
OWin认证框架的重点在于它是完全模块化的。只需运行'Install-Package Microsoft.Owin.Security.Cookies'并将其安装在您的'IAppBuilder'上。 – Aron
为什么你不想使用身份? OWIN是注入认证的新方式。如果你不喜欢它,建立你自己的OWIN模块并注入那个模块?身份是验证用户身份的新方法。如果你不喜欢整个社交认证部分,那就不要使用它。 FormsAuthentication是一种很老的方式。 –
亲切地检查我的答案在这里:http://*.com/questions/26485575/它可能会帮助你 – Monah