フォーム認証によるロールベースのアクセス制御アクセス制御の仕方
認証を行うクラス
認証ユーザの参照 public ActionResult Index() {
var user = HttpContext.User;
}
実装例MembershipProvider public class MyCustomMembershipProvider : MembershipProvider
{
public override bool ValidateUser(string username, string password)
{
if (username == "admin" && password == "123456") {
return true;
}
if (username == "user" && password == "123456") {
return true;
}
return false;
}
これ以外のMembershipProviderの抽象メソッドは取り敢えず未実装で良い。 RoleProvider public class MyCustomRoleProvider : RoleProvider
{
public override bool IsUserInRole(string username, string roleName)
{
if (username == "admin" && roleName == "Administrators") {
return true;
}
else if (username != "admin" && roleName == "Users") {
return true;
}
return false;
}
public override string[] GetRolesForUser(string username)
{
if (username == "admin") {
return new string[] { "Administrators" };
}
else {
return new string[] { "Users" };
}
}
これ以外のRoleProviderの抽象メソッドは取り敢えず未実装で良い。 web.config <system.web>
<authentication mode="Forms" >
<forms loginUrl="~/Login/Index"></forms>
</authentication>
<membership defaultProvider="myCustomMembershipProvider">
<providers>
<clear />
<add name="myCustomMembershipProvider" type="WebApplication1.MyCustomMembershipProvider" />
</providers>
</membership>
<roleManager enabled="true" defaultProvider="myCustomRoleProvider">
<providers>
<clear/>
<add name="myCustomRoleProvider" type="WebApplication1.MyCustomRoleProvider" />
</providers>
</roleManager>
Loginコントローラ public class LoginController : Controller
{
readonly MyCustomMembershipProvider _membershipProvider = new MyCustomMembershipProvider();
public ActionResult Index()
{
FormsAuthentication.SignOut();
return View();
}
[HttpPost]
public ActionResult Index(UserEntity user)
{
if (_membershipProvider.ValidateUser(user.Username, user.Password)) {
FormsAuthentication.SetAuthCookie(user.Username, false);
return RedirectToAction("Index", "Home");
}
ViewBag.Message = "Username or Password is incorrect.";
return View(user);
}
}
以上でMembershipProviderを使ってユーザ認証を行う。 Loginビュー @model WebApplication1.UserEntity
@{
ViewBag.Title = "Index";
}
<h2>Index</h2>
<div>@ViewBag.Message</div>
@using (Html.BeginForm()) {
@Html.EditorFor(m => m)
<input type="submit" value="LOGIN" />
}
Loginビューモデル public class UserEntity
{
public string Username { get; set; }
public string Password { get; set; }
}
アクセス制御をするアクションクラス・メソッド public class HomeController : Controller
{
[Authorize]
public ActionResult Index()
{
return View();
}
[Authorize(Roles="Administrators")]
public ActionResult Index2()
{
return View();
}
}
参考
外部認証 app_start\startup.auth.cshttp://weblogs.asp.net/imranbaloch/archive/2013/07/18/configuring-asp-net-mvc-5-login-options.aspx |
|
