Question

我在mvc项目中使用了表单身份验证。
我创建了一个CustomRoleProvider并实现了两个方法：
IsUserInRole和GetRolesForUser

Web.config

<roleManager defaultProvider="CustomRoleProvider" enabled="true">
  <providers>
    <clear />
    <add name="CustomRoleProvider"  type="SASS.UI.CustomRoleProvider" connectionStringName="AfterSaleConnection"  />
  </providers>
</roleManager>

FilterConfig

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    ...
    filters.Add(new AuthorizeAttribute());
}

CustomRoleProvider

public class CustomRoleProvider : RoleProvider
{
    private readonly IUserService _userServices;


    public CustomRoleProvider()
    {

        this._userServices = new UserServices(new Context());
    }
    public override bool IsUserInRole(string username, string roleName)
    {

        var user = _userServices.GetUser(username.GetUserId());

        if (user.IsAdmin)
            return true;

        return user.UserAccess.Any(y => (y.Role.ToString().ToLower() == roleName.ToLower()));
    }

    public override string[] GetRolesForUser(string username)
    {
        var user = _userServices.GetUser(username.GetUserId());

        List<string> accessList = new List<string>();

        if (user.UserAccess.Any(x => x.Role == Access.Admin))
        {
            foreach (Access access in Enum.GetValues(typeof(Access)))
            {

                accessList.Add(access.ToString().ToLower());
            }
            return accessList.ToArray();
        }
        var roles= user.UserAccess.Select(x => x.Role.ToString().ToLower()).ToArray();
        return roles;
    }

    public override void CreateRole(string roleName)
    {
        throw new NotImplementedException();
    }

    public override bool DeleteRole(string roleName, bool throwOnPopulatedRole)
    {
        throw new NotImplementedException();
    }

    public override bool RoleExists(string roleName)
    {
        throw new NotImplementedException();
    }

    public override void AddUsersToRoles(string[] usernames, string[] roleNames)
    {
        throw new NotImplementedException();
    }

    public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames)
    {
        throw new NotImplementedException();
    }

    public override string[] GetUsersInRole(string roleName)
    {
        throw new NotImplementedException();
    }

    public override string[] GetAllRoles()
    {
        throw new NotImplementedException();
    }

    public override string[] FindUsersInRole(string roleName, string usernameToMatch)
    {
        throw new NotImplementedException();
    }

    public override string ApplicationName { get; set; }
}

我还在控制器上方添加了authorize属性，并执行了以下操作：

[Authorize(Roles = "admin")]
public virtual ActionResult List()
{
    return View("CustomerList");
}

但是，当用户请求访问他不具有admin角色的操作时，他可以打开它！

我运行我的项目，并在IsUserInRoles方法中设置了一个断点，但是它永远不会触发！问题出在哪里？

IsUserInRole没有在我的CustomRoleProvider中执行

0 个答案: