asp.net core的認證和受權

時間  2021-01-21
標籤 css html 前端 jquery git github web ajax chrome 數據庫 欄目 ASP 简体版
原文   原文鏈接

在asp.net core中，微軟提供了基於認證（Authentication）和受權（Authorization）的方式，來實現權限管理的，本篇博文，介紹基於固定角色的權限管理和自定義角色權限管理，本文內容，更適合傳統行業的BS應用，而非互聯網應用。css

在asp.net core中，咱們認證（Authentication）一般是在Login的Post Action中進行用戶名或密碼來驗證用戶是否正確，若是經過驗證，即該用戶就會得到一個或幾個特定的角色，經過ClaimTypes.Role來存儲角色，從而當一個請求到達時，用這個角色和Controller或Action上加的特性 [Authorize(Roles = "admin,system")]來受權是否有權訪問該Action。本文中的自定義角色，會把驗證放在中間件中進行處理。html


  • 固定角色：前端

即把角色與具體的Controller或Action直接關聯起來，整個系統中的角色是固定的，每種角色能夠訪問那些Controller或Action也是固定的，這作法比較適合小型項目，角色分工很是明確的項目。jquery

項目代碼：git

https://github.com/axzxs2001/Asp.NetCoreExperiment/tree/master/Asp.NetCoreExperiment/%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86/RolePrivilegeManagementgithub

始於startup.csweb

須要在ConfigureServices中注入Cookie的相關信息，options是CookieAuthenticationOptions，關於這個類型提供以下屬性，可參考：https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?tabs=aspnetcore2xajax

 

它提供了登陸的一些信息，或登陸生成Cookie的一些信息，用之後chrome

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;

namespace RolePrivilegeManagement
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }


        public void ConfigureServices(IServiceCollection services)
        {        
            services.AddMvc();
            //添加認證Cookie信息
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
             .AddCookie(options =>
             {
                 options.LoginPath = new PathString("/login");
                 options.AccessDeniedPath = new PathString("/denied");
             });
        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseBrowserLink();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }
            app.UseStaticFiles();
            //驗證中間件
            app.UseAuthentication();
            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }
}

HomeController.cs數據庫

對於Login Get的Action，把returnUrl用戶想要訪問的地址（有可能用戶記錄下想要訪問的url了，但系統會轉到登陸頁，登陸成功後直接跳轉到想要訪問的returnUrl頁）

對於Login Post的Action，驗證用戶密和密碼，成功能，定義一個ClaimsIdentity，把用戶名和角色，和用戶姓名的聲明都添回進來（這個角色，就是用來驗證可訪問action的角色 ）做來該用戶標識，接下來調用HttpContext.SignInAsync進行登陸，注意此方法的第一個參數，必需與StartUp.cs中services.AddAuthentication的參數相同，AddAuthentication是設置登陸，SigninAsync是按設置參數進行登陸

對於Logout Get的Action，是退出登陸

HomeController上的[Authorize(Roles=」admin,system」)]角色和權限的關係時，全部Action只有admin和system兩個角色能訪問到，About上的[Authorize(Roles=」admin」)]聲明這個action只能admin角色訪問，Contact上的[Authorize(Roles=」system」)]聲明這個action只能system角色訪問，若是action上聲明的是[AllowAnomymous]，說明不受受權管理，能夠直接訪問。

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using RolePrivilegeManagement.Models;
using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;

namespace RolePrivilegeManagement.Controllers
{
    [Authorize(Roles = "admin,system")]
    public class HomeController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }
        [Authorize(Roles = "admin")]
        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";
            return View();
        }
        [Authorize(Roles = "system")]
        public IActionResult Contact()
        {
            ViewData["Message"] = "Your contact page.";
            return View();
        }
        public IActionResult Error()
        {
            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
        }
        [AllowAnonymous]
        [HttpGet("login")]
        public IActionResult Login(string returnUrl = null)
        {
            TempData["returnUrl"] = returnUrl;
            return View();
        }
        [AllowAnonymous]
        [HttpPost("login")]
        public async Task<IActionResult> Login(string userName, string password, string returnUrl = null)
        {
            var list = new List<dynamic> {
                new { UserName = "gsw", Password = "111111", Role = "admin",Name="桂素偉" },
                new { UserName = "aaa", Password = "222222", Role = "system",Name="測試A" }
            };
            var user = list.SingleOrDefault(s => s.UserName == userName && s.Password == password);
            if (user!=null)
            {
                //用戶標識
                var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
                identity.AddClaim(new Claim(ClaimTypes.Sid, userName));
                identity.AddClaim(new Claim(ClaimTypes.Name, user.Name));
                identity.AddClaim(new Claim(ClaimTypes.Role, user.Role));

                await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));
                if (returnUrl == null)
                {
                    returnUrl = TempData["returnUrl"]?.ToString();
                }
                if (returnUrl != null)
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction(nameof(HomeController.Index), "Home");
                }
            }
            else
            {
                const string badUserNameOrPasswordMessage = "用戶名或密碼錯誤！";
                return BadRequest(badUserNameOrPasswordMessage);
            }
        }
        [HttpGet("logout")]
        public async Task<IActionResult> Logout()
        {
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            return RedirectToAction("Index", "Home");
        }
        [AllowAnonymous]
        [HttpGet("denied")]
        public IActionResult Denied()
        {
            return View();
        }
    }
}

前端_Layout.cshtml佈局頁，在登陸成功後的任何頁面均可以用@User.Identity.Name就能夠獲取用戶姓名，同時用@User.Claims.SingleOrDefault(s=>s.Type==System.Security.Claims.ClaimTypes.Sid).Value能夠獲取用戶名或角色。

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>@ViewData["Title"] - RolePrivilegeManagement</title>

    <environment include="Development">
        <link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.css" />
        <link rel="stylesheet" href="~/css/site.css" />
    </environment>
    <environment exclude="Development">
        <link rel="stylesheet" href="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.7/css/bootstrap.min.css"
              asp-fallback-href="~/lib/bootstrap/dist/css/bootstrap.min.css"
              asp-fallback-test-class="sr-only" asp-fallback-test-property="position" asp-fallback-test-value="absolute" />
        <link rel="stylesheet" href="~/css/site.min.css" asp-append-version="true" />
    </environment>
    <style>

        /* 未訪問的連接 */
        a.logout:link {
            color: #9d9d9d
        }
        /* 已訪問的連接 */
        a.logout:visited {
            color: #9d9d9d
        }
        /* 當有鼠標懸停在連接上 */
        a.logout:hover {
            color: #ffffff
        }
        /* 被選擇的連接 */
        a.logout:active {
            color: #9d9d9d
        }
        a.logout{
            text-decoration:none;
        }
        
    </style>
</head>
<body>
    <nav class="navbar navbar-inverse navbar-fixed-top">
        <div class="container">
            <div class="navbar-header">
                <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
                    <span class="sr-only">Toggle navigation</span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                </button>
                <a asp-area="" asp-controller="Home" asp-action="Index" class="navbar-brand">RolePrivilegeManagement</a>
            </div>
            <div class="navbar-collapse collapse">
                <ul class="nav navbar-nav">
                    <li><a asp-area="" asp-controller="Home" asp-action="Index">Home</a></li>
                    <li><a asp-area="" asp-controller="Home" asp-action="About">About</a></li>
                    <li><a asp-area="" asp-controller="Home" asp-action="Contact">Contact</a></li>
                </ul>
                <ul class="" style="float:right; margin:0;">
                    <li style="overflow:hidden;">
                        <div style="float:left;line-height:50px;margin-right:10px;">
                            <span style="color:#ffffff">當前用戶：@User.Identity.Name</span>
                        </div>
                        <div style="float:left;line-height:50px;">
                            <a asp-area="" asp-controller="Home" asp-action="Logout" class="logout">註銷</a>
                        </div>
                    </li>
                </ul>
            </div>
        </div>
    </nav>
    <div class="container body-content">
        @RenderBody()
        <hr />
        <footer>
            <p>&copy; 2017 - RolePrivilegeManagement</p>
        </footer>
    </div>

    <environment include="Development">
        <script src="~/lib/jquery/dist/jquery.js"></script>
        <script src="~/lib/bootstrap/dist/js/bootstrap.js"></script>
        <script src="~/js/site.js" asp-append-version="true"></script>
    </environment>
    <environment exclude="Development">
        <script src="https://ajax.aspnetcdn.com/ajax/jquery/jquery-2.2.0.min.js"
                asp-fallback-src="~/lib/jquery/dist/jquery.min.js"
                asp-fallback-test="window.jQuery"
                crossorigin="anonymous"
                integrity="sha384-K+ctZQ+LL8q6tP7I94W+qzQsfRV2a+AfHIi9k8z8l9ggpc8X+Ytst4yBo/hH+8Fk">
        </script>
        <script src="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.7/bootstrap.min.js"
                asp-fallback-src="~/lib/bootstrap/dist/js/bootstrap.min.js"
                asp-fallback-test="window.jQuery && window.jQuery.fn && window.jQuery.fn.modal"
                crossorigin="anonymous"
                integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa">
        </script>
        <script src="~/js/site.min.js" asp-append-version="true"></script>
    </environment>

    @RenderSection("Scripts", required: false)
</body>
</html>

如今能夠用chrome運行了，進行登陸頁後F12，查看Network—Cookies，能夠看到有一個Cookie，這個是記錄returnUrl的Cookie，是否記得HomeController.cs中的Login Get的Action中代碼：TempData["returnUrl"]= returnUrl;這個TempData最後轉成了一個Cookie返回到客戶端了，以下圖：

wKiom1mpGpLQHK6sAAHPY4rMP-M710.png-wh_50

輸入用戶名，密碼登陸，再次查看Cookies，發現多了一個.AspNetCore.Cookies，即把用戶驗證信息加密碼保存在了這個Cookie中，當跳轉到別的頁面時，這兩個Cookie會繼續在客戶端和服務傳送，用以驗證用戶角色。

wKioL1mpGo6zQf3AAAI-Xqy1O8E005.png-wh_50

  • 自定義角色

系統的角色能夠自定義，用戶是自寫到義，權限是固定的，角色對應權限能夠自定義，用戶對應角色也是自定義的，以下圖：

wKioL1mpGrjDmAwhAAA59BjyIl4220.png-wh_50

項目代碼：

https://github.com/axzxs2001/Asp.NetCoreExperiment/tree/master/Asp.NetCoreExperiment/%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86/PrivilegeManagement

始於startup.cs

自定義角色與固定角色不一樣之處在於多了一箇中間件（關於中間件學習參看：https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware），即在Configure方法中，必定要在app.UseAuthentication下面添加驗證權限的中間件，由於UseAuthentication要從Cookie中加載經過驗證的用戶信息到Context.User中，因此必定放在加載完後才能去驗用戶信息（固然本身讀取Cookie也能夠）

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;
using PrivilegeManagement.Middleware;

namespace PrivilegeManagement
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }
        public IConfiguration Configuration { get; }

        public void ConfigureServices(IServiceCollection services)
        {
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
           .AddCookie(options =>
           {
               options.LoginPath = new PathString("/login");
               options.AccessDeniedPath = new PathString("/denied");
           }
           );
            services.AddMvc();
        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseBrowserLink();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();
            //驗證中間件
            app.UseAuthentication();
            ////添加權限中間件, 必定要放在app.UseAuthentication後
            app.UsePermission(new PermissionMiddlewareOption()
            {
                LoginAction = @"/login",
                NoPermissionAction = @"/denied",
                //這個集合從數據庫中查出全部用戶的所有權限
                UserPerssions = new List<UserPermission>()
                 {
                     new UserPermission { Url="/", UserName="gsw"},
                     new UserPermission { Url="/home/contact", UserName="gsw"},
                     new UserPermission { Url="/home/about", UserName="aaa"},
                     new UserPermission { Url="/", UserName="aaa"}
                 }
            });
            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }
}

下面看看中間件PermissionMiddleware.cs，在Invoke中用了context.User，如上面所述，首先要調用app.UseAuthentication加載用戶信息後才能在這裏使用，這個中間件邏輯較簡單，若是沒有驗證的一概放過去，不做處理，若是驗證過（登陸成功了），就要查看本次請求的url和這個用戶能夠訪問的權限是否匹配，如不匹配，就跳轉到拒絕頁面（這個是在Startup.cs中添加中間件時，用NoPermissionAction = @"/denied"設置的），這裏定義了一個靜態的List<UserPermission>，這是爲了熱更新此集合，而不須要用戶權限變動後從新整個web應用。

using Microsoft.AspNetCore.Http;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Security.Claims;
using System.Threading.Tasks;

namespace PrivilegeManagement.Middleware
{
    /// <summary>
    /// 權限中間件
    /// </summary>
    public class PermissionMiddleware
    {
        /// <summary>
        /// 管道代理對象
        /// </summary>
        private readonly RequestDelegate _next;
        /// <summary>
        /// 權限中間件的配置選項
        /// </summary>
        private readonly PermissionMiddlewareOption _option;

        /// <summary>
        /// 用戶權限集合
        /// </summary>
        internal static List<UserPermission> _userPermissions;

        /// <summary>
        /// 權限中間件構造
        /// </summary>
        /// <param name="next">管道代理對象</param>
        /// <param name="permissionResitory">權限倉儲對象</param>
        /// <param name="option">權限中間件配置選項</param>
        public PermissionMiddleware(RequestDelegate next, PermissionMiddlewareOption option)
        {
            _option = option;
            _next = next;
            _userPermissions = option.UserPerssions;
        }       
        /// <summary>
        /// 調用管道
        /// </summary>
        /// <param name="context">請求上下文</param>
        /// <returns></returns>
        public Task Invoke(HttpContext context)
        {
            //請求Url
            var questUrl = context.Request.Path.Value.ToLower();
       
            //是否通過驗證
            var isAuthenticated = context.User.Identity.IsAuthenticated;
            if (isAuthenticated)
            {
                if (_userPermissions.GroupBy(g=>g.Url).Where(w => w.Key.ToLower() == questUrl).Count() > 0)
                {
                    //用戶名
                    var userName = context.User.Claims.SingleOrDefault(s => s.Type == ClaimTypes.Sid).Value;
                    if (_userPermissions.Where(w => w.UserName == userName&&w.Url.ToLower()==questUrl).Count() > 0)
                    {
                        return this._next(context);
                    }
                    else
                    {
                        //無權限跳轉到拒絕頁面
                        context.Response.Redirect(_option.NoPermissionAction);
                    }
                }
            }
            return this._next(context);
        }
    }
}

擴展中間件類PermissionMiddlewareExtensions.cs

using Microsoft.AspNetCore.Builder;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace PrivilegeManagement.Middleware
{
    /// <summary>
    /// 擴展權限中間件
    /// </summary>
    public static class PermissionMiddlewareExtensions
    {
        /// <summary>
        /// 引入權限中間件
        /// </summary>
        /// <param name="builder">擴展類型</param>
        /// <param name="option">權限中間件配置選項</param>
        /// <returns></returns>
        public static IApplicationBuilder UsePermission(
              this IApplicationBuilder builder, PermissionMiddlewareOption option)
        {
            return builder.UseMiddleware<PermissionMiddleware>(option);
        }

    }
}

中間件屬性PermissionMiddlewareOption.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace PrivilegeManagement.Middleware
{
    /// <summary>
    /// 權限中間件選項
    /// </summary>
    public class PermissionMiddlewareOption
    {
        /// <summary>
        /// 登陸action
        /// </summary>
        public string LoginAction
        { get; set; }
        /// <summary>
        /// 無權限導航action
        /// </summary>
        public string NoPermissionAction
        { get; set; }

        /// <summary>
        /// 用戶權限集合
        /// </summary>
        public List<UserPermission> UserPerssions
        { get; set; } = new List<UserPermission>();
    }
}

中間件實體類UserPermission.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace PrivilegeManagement.Middleware
{
    /// <summary>
    /// 用戶權限
    /// </summary>
    public class UserPermission
    {
        /// <summary>
        /// 用戶名
        /// </summary>
        public string UserName
        { get; set; }
        /// <summary>
        /// 請求Url
        /// </summary>
        public string Url
        { get; set; }
    }
}

關於自定義角色，由於不須要受權時帶上角色，因此能夠定義一個基Controller類BaseController.cs，其餘的Controller都繼承BaseController，這樣全部的action均可以經過中間件來驗證，固然像登陸，無權限提示頁面仍是在Action上加[AllowAnomymous]

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace PrivilegeManagement.Controllers
{
    [Authorize]
    public class BaseController:Controller
    {
    }
}

HomeController.cs以下，與固定角色的HomeController.cs差別只在Controller和Action上的Authorize特性。

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using PrivilegeManagement.Models;
using Microsoft.AspNetCore.Authorization;
using System.Security.Claims;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication;

namespace PrivilegeManagement.Controllers
{
 
    public class HomeController : BaseController
    {
        public IActionResult Index()
        {
            return View();
        }

        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";
            
            return View();
        }

        public IActionResult Contact()
        {
            ViewData["Message"] = "Your contact page.";

            return View();
        }

        public IActionResult Error()
        {
            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
        }
        [AllowAnonymous]
        [HttpGet("login")]
        public IActionResult Login(string returnUrl = null)
        {
            TempData["returnUrl"] = returnUrl;
            return View();
        }
        [AllowAnonymous]
        [HttpPost("login")]
        public async Task<IActionResult> Login(string userName,string password, string returnUrl = null)
        {
            var list = new List<dynamic> {
                new { UserName = "gsw", Password = "111111", Role = "admin",Name="桂素偉" },
                new { UserName = "aaa", Password = "222222", Role = "system",Name="測試A" }
            };
            var user = list.SingleOrDefault(s => s.UserName == userName && s.Password == password);
            if (user != null)
            {
                //用戶標識
                var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
                identity.AddClaim(new Claim(ClaimTypes.Sid, userName));
                identity.AddClaim(new Claim(ClaimTypes.Name, user.Name));
                identity.AddClaim(new Claim(ClaimTypes.Role, user.Role));

                await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));
                if (returnUrl == null)
                {
                    returnUrl = TempData["returnUrl"]?.ToString();
                }
                if (returnUrl != null)
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction(nameof(HomeController.Index), "Home");
                }
            }
            else
            {
                const string badUserNameOrPasswordMessage = "用戶名或密碼錯誤！";
                return BadRequest(badUserNameOrPasswordMessage);
            }
        }
        [HttpGet("logout")]
        public async Task<IActionResult> Logout()
        {
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            return RedirectToAction("Index", "Home");
        }
        [HttpGet("denied")]
        public IActionResult Denied()
        {
            return View();
        }
    }

 
}


所有代碼：https://github.com/axzxs2001/Asp.NetCoreExperiment/tree/master/Asp.NetCoreExperiment/%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86

相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程