基于角色的身份验证3

数据库表

 

CREATE 
DATABASE web

CREATE TABLE users
(
    username nvarchar(64) CONSTRAINT users_PK PRIMARY KEY,
    password nvarchar(128),
    roles nvarchar(64)
)

CREATE INDEX credentials ON users
(
    username,
    password
)

内容
 格式
 

username  |password      |roles
"hstewart"|"codeproject" |"Administrator,User"
"joe"     |"schmoe"      |"User"

web.config 的设置  
 

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    
  <system.web>

  
    <compilation 
         defaultLanguage="c#"
         debug="true"
    />

   
    <customErrors 
    mode="RemoteOnly" 
    /> 

   
 <authentication mode="Forms">
            <forms name="MYWEBAPP.ASPXAUTH"
                loginUrl="login.aspx"
                protection="All"
                path="/"/>
        </authentication>
        <authorization>
              <allow users="*"/>
        </authorization>

    <trace
        enabled="false"
        requestLimit="10"
        pageOutput="false"
        traceMode="SortByTime"
        localOnly="true"
    />

    
    <sessionState 
            mode="InProc"
            stateConnectionString="tcpip=127.0.0.1:42424"
            sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes"
            cookieless="false" 
            timeout="20" 
    />

    <globalization 
            requestEncoding="utf-8" 
            responseEncoding="utf-8" 
   />
   
 </system.web>
<location path="administrators">
        <system.web>
            <authorization>
                <!-- Order and case are important below -->
                <allow roles="Administrator"/>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>
    <location path="users">
        <system.web>
            <authorization>
                <!-- Order and case are important below -->
                <allow roles="User"/>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>
</configuration>

 

    

Global.asax

    protected void Application_AuthenticateRequest(Object sender, EventArgs e)
        {
            if (HttpContext.Current.User != null)
            {
                if (HttpContext.Current.User.Identity.IsAuthenticated)
                {
                    if (HttpContext.Current.User.Identity is FormsIdentity)
                    {
                        FormsIdentity id =
                            (FormsIdentity)HttpContext.Current.User.Identity;
                        FormsAuthenticationTicket ticket = id.Ticket;

                        // Get the stored user-data, in this case, our roles
                        string userData = ticket.UserData;
                        string[] roles = userData.Split(',');
                        HttpContext.Current.User = new GenericPrincipal(id, roles);
                    }
                }
            }

        }

上边的难证代码和下边是一样的,有兴趣可以看一下。。。。 

 

 System.Web .HttpApplication  app=((HttpApplication)sender);
           System.Web.HttpContext  ctx=app.Context;
            if (ctx.Request .IsAuthenticated)

   



     login.aspx 
  

private void Button1_Click(object sender, System.EventArgs e)
        {
            // Initialize FormsAuthentication, for what it's worth
            FormsAuthentication.Initialize();

            // Create our connection and command objects
            SqlConnection conn =
                new SqlConnection("server=localhost;database=web;User ID=sa;password=");
            SqlCommand cmd = conn.CreateCommand();
            cmd.CommandText = "SELECT roles FROM users WHERE username=@username " +
                "AND password=@password";

            // Fill our parameters
            cmd.Parameters.Add("@username", SqlDbType.NVarChar, 64).Value =
                Username.Text;
            cmd.Parameters.Add("@password", SqlDbType.NVarChar, 128).Value =
                Password.Text; // Or "sha1"

            // Execute the command
            conn.Open();
            SqlDataReader reader = cmd.ExecuteReader();
            if (reader.Read())
            {
                // Create a new ticket used for authentication
                FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                    1, // Ticket version
                    Username.Text, // Username associated with ticket
                    DateTime.Now, // Date/time issued
                    DateTime.Now.AddMinutes(30), // Date/time to expire
                    true, // "true" for a persistent user cookie
                    reader.GetString(0), // User-data, in this case the roles
                    FormsAuthentication.FormsCookiePath);// Path cookie valid for

                // Encrypt the cookie using the machine key for secure transport
                string hash = FormsAuthentication.Encrypt(ticket);
                HttpCookie cookie = new HttpCookie(
                    FormsAuthentication.FormsCookieName, // Name of auth cookie
                    hash); // Hashed ticket

                // Set the cookie's expiration time to the tickets expiration time
                if (ticket.IsPersistent) cookie.Expires = ticket.Expiration;

                // Add the cookie to the list for outgoing response
                Response.Cookies.Add(cookie);

                // Redirect to requested URL, or homepage if no previous page
                // requested
                string returnUrl = Request.QueryString["ReturnUrl"];
                if (returnUrl == null) returnUrl = "/";

                // Don't call FormsAuthentication.RedirectFromLoginPage since it
                // could
                // replace the authentication ticket (cookie) we just added
                Response.Redirect(returnUrl);
            }
            else
            {
                // Never tell the user if just the username is password is incorrect.
                // That just gives them a place to start, once they've found one or
                // the other is correct!
                ErrorLabel.Text = "Username / password incorrect. Please try again.";
                ErrorLabel.Visible = true;
            }

            reader.Close();
            conn.Close();
        }

在根目录下建 
administrators  目录
users          目录

 两个目录下分别建调用页面 

 调用页面内容
 

  private void Page_Load(object sender, System.EventArgs e)
  {
   // 在此处放置用户代码以初始化页面

   if (User.IsInRole("Administrator"))
    this.Response .Write ("Administrator"); 
   if (User.IsInRole ("User"))
    this.Response .Write ("User");

  }

   

  
  转自

 http://www.codeproject.com/aspnet/formsroleauth.asp