Forms身份验证及MemberShip权限认证

Forms 身份验证 .cs

private void AuthenticateRequest(object sender, EventArgs e)
        {
            HttpApplication app = sender as HttpApplication;
            HttpContext context = app.Context;
            if (context==null||context.User==null||!context.User.Identity.IsAuthenticated)
            {
                return;
            }
            else
            {

                HttpCookie cookie = context.Request.Cookies[FormsAuthentication.FormsCookieName];
                FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(cookie.Value);
                string[] roles = authTicket.UserData.Split(new char[] { ',' });
                context.User = new GenericPrincipal(context.User.Identity, roles);
                //string strUserID = authTicket.Name; //以下为自定义权限验证
                //if (!hasRoles(strUserID,roles))
                //{
                //    context.Response.Redirect("Error.aspx");                   
                //}
            }

 

MemberShip权限验证

添加HttpModule模块

using System;
using System.Collections.Generic;
using System.Text;
using System.Web;
using System.Web.Security;
using System.Security.Principal;

namespace InternalAID.AuthorRoles
{
    public class CustomModule : IHttpModule
    {
        public CustomModule() { }
        public void Dispose() { }
        public void Init(HttpApplication app)
        { 
            app.AuthenticateRequest += new EventHandler(this.AuthenticateRequest);
        }

        private void AuthenticateRequest(object sender, EventArgs e)
        {
            HttpApplication app = sender as HttpApplication;
            HttpContext context = app.Context;
            if (context==null||context.User==null||!context.User.Identity.IsAuthenticated)
            {
                return;
            }
            else
            {

                HttpCookie cookie = context.Request.Cookies[FormsAuthentication.FormsCookieName];
                FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(cookie.Value);
                string[] roles = authTicket.UserData.Split(new char[] { ',' });
                context.User = new GenericPrincipal(context.User.Identity, roles);
                //string strUserID = authTicket.Name; //以下为自定义权限验证
                //if (!hasRoles(strUserID,roles))
                //{
                //    context.Response.Redirect("Error.aspx");                   
                //}
            }

        }

        bool hasRoles(string userID,string[] roles)
        {
            return true; 
        }
    }

 

Web.Config配置

<authentication mode="Forms">
            <forms loginUrl="login.aspx" name=".FormsAspX" path="/" timeout="30"></forms>
        </authentication>        
<httpModules>
            <add name="RoleAuth" type="InternalAID.AuthorRoles.CustomModule,InternalAID.AuthorRoles"/>
        </httpModules>

 

需要验证的目录

Web.Config

<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
      <authorization>
        <deny users="?"  roles="admin"/>
      </authorization>
    </system.web>
</configuration