Asp.net mvc MVC 5中用于Active Directory身份验证的自定义角色

因此，我创建了一个测试MVC5Web应用程序，它具有“Windows身份验证”。现在我想根据预定义的角色隐藏/显示/允许访问应用程序的不同部分。我的角色可以硬编码为“管理员”和“用户”

这意味着我需要一个包含windows登录名及其角色的表。现在的问题是，我如何获得类似于MVC身份已经提供的“授权”的东西。示例

[Authorize（Roles=“Admin”）]

。我猜这段代码会自动从表AspNetUserRoles中获取登录用户的信息

---

我可以手动创建表AspNetUsers、AspNetRoles、AspNetUserRoles。然后用所需的数据填充它们，它会工作吗？表AspNetUsers中的密码可以硬编码，因为我不会将其用于登录目的。请提出建议。

您需要的是将代码跟踪到ClaimsEntity创建并添加一个新声明：ClaimTypes.Role

private ClaimsIdentity CreateIdentity(UserPrincipal userPrincipal)
            {
            var identity = new ClaimsIdentity(
                Startup.MyAuthentication.ApplicationCookie,
                ClaimsIdentity.DefaultNameClaimType,
                ClaimsIdentity.DefaultRoleClaimType);   

            identity.AddClaim(new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "Active Directory"));
            identity.AddClaim(new Claim(ClaimTypes.Name, userPrincipal.SamAccountName));

            if (userPrincipal.SamAccountName == "flastname" 
                || userPrincipal.Name == "FirstName LastName")
                {
                    // this will add role to the user, you can add as many as you want
                    identity.AddClaim(new Claim(ClaimTypes.Role, "Administrator"));
                }

            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, userPrincipal.SamAccountName));
            if (!String.IsNullOrEmpty(userPrincipal.EmailAddress))
            {
                identity.AddClaim(new Claim(ClaimTypes.Email, userPrincipal.EmailAddress));
            }

            // add your own claims if you need to add more information stored on the cookie

            return identity;
        }

---

您需要的是将代码跟踪到ClaimsIdentity创建，并添加一个新声明：ClaimTypes.Role

private ClaimsIdentity CreateIdentity(UserPrincipal userPrincipal)
            {
            var identity = new ClaimsIdentity(
                Startup.MyAuthentication.ApplicationCookie,
                ClaimsIdentity.DefaultNameClaimType,
                ClaimsIdentity.DefaultRoleClaimType);   

            identity.AddClaim(new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "Active Directory"));
            identity.AddClaim(new Claim(ClaimTypes.Name, userPrincipal.SamAccountName));

            if (userPrincipal.SamAccountName == "flastname" 
                || userPrincipal.Name == "FirstName LastName")
                {
                    // this will add role to the user, you can add as many as you want
                    identity.AddClaim(new Claim(ClaimTypes.Role, "Administrator"));
                }

            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, userPrincipal.SamAccountName));
            if (!String.IsNullOrEmpty(userPrincipal.EmailAddress))
            {
                identity.AddClaim(new Claim(ClaimTypes.Email, userPrincipal.EmailAddress));
            }

            // add your own claims if you need to add more information stored on the cookie

            return identity;
        }

---

对不起，这是重复的：@ataravati，我实际上想使用Authorize，而不是您在其他链接中提到的方式。您不能使用Authorize，除非您使用NT组作为角色。@ataravati，哦！集成电路。谢谢您提供的信息。对不起，这是重复的：@ataravati，我实际上想使用Authorize，而不是您在其他链接中提到的方式。您不能使用Authorize，除非您使用NT组作为角色。@ataravati，噢！集成电路。谢谢你提供的信息。