基于mvc5+ef6+Bootstrap框架实现身份验证和权限管理
近和朋友完成了一个大单子架构是mvc5+ef6+bootstrap,用的是vs2015,数据库是sql server2014。朋友做的架构,项目完成后觉得很多值得我学习,在这里总结下一些心得。
创建项目一开始删掉app_start目录下的identityconfig.cs和startup.auth.cs文件;清空modle文件夹,controller文件夹和相应的view; 删除目录下的applicationinsights.config文件和startup.cs文件
修改web.config文件(添加<add key="owin:automaticappstartup" value="false"/>不使用startup.cs文件来启动项目)
<appsettings> <add key="webpages:version" value="3.0.0.0" /> <add key="webpages:enabled" value="false" /> <add key="clientvalidationenabled" value="true" /> <add key="unobtrusivejavascriptenabled" value="true" /> <add key="owin:automaticappstartup" value="false"/> <!--去掉创建项目初的startup.cs文件的设置--> </appsettings>
(不用他们是因为自带的这些内容太冗余)
去掉冗余内容正式开始,首先介绍数据库这一块,数据库我们是配置的可以手动生成和修改的
1.在项目目录想创建migrations文件夹,里面添加configuration.cs文件
internal sealed class configuration : dbmigrationsconfiguration<accountcontext> { public configuration() { automaticmigrationsenabled = true; contextkey = "userproject.dal.accountcontext"; } protected override void seed(accountcontext context) { //base.seed(context); } }
在modle文件夹下添加accountcontext.cs文件
public class accountcontext:dbcontext { public accountcontext():base("accountcontext") { } public dbset<user> users { get; set; } protected override void onmodelcreating(dbmodelbuilder modelbuilder) { modelbuilder.conventions.remove<pluralizingtablenameconvention>(); } } <connectionstrings> <add name="accountcontext" connectionstring="data source=(localdb)\mssqllocaldb;attachdbfilename=|datadirectory|\userproject.mdf;initial catalog=userproject;integrated security=true" providername="system.data.sqlclient" /> </connectionstrings>
然后 使用vs2015里面的工具-nuget包管理器-程序包管理控制平台
输入add-migration initial 按回车,在输入update-database按回车。在app_data文件夹下就会看到accountcontext数据库了。
2.在modle文件夹下添加user.css文件
public class user { public int id { get; set; } public string username { get; set; } public string password { get; set; } public role role { get; set; } } public enum role//角色枚举 { 管理员 = 0, 员工 = 1, 经理 = 2, 总经理 = 3, 董事长 = 4 }
在viewmodle文件夹中添加account.cs文件
public class account { [required] public string name { get; set; } [required] public string password { get; set; } public string repassword { get; set; } }
这里推荐创建basecontroller之后的controller就继承它来使用
public class basecontroller : controller { public string username => user.identity.name; public accountcontext db = new accountcontext(); private user _userinfo = null; public user currentuserinfo { get { if (_userinfo == null) { var user = db.users.singleordefault(u => u.username == username);//此处为了不每次访问用户表可以做一个静态类,里面存放用户表信息. _userinfo = user == null ? null : new user() { id = user.id, username = user.username, role = user.role }; } return _userinfo; } } //验证角色:获取action的customattributes,过滤角色 protected override void onactionexecuting(actionexecutingcontext filtercontext) { base.onactionexecuting(filtercontext); var authroleatt = filtercontext.actiondescriptor.getcustomattributes(false).singleordefault(att => att is authorizeroleattribute) as authorizeroleattribute; if (authroleatt == null && currentuserinfo != null) return; if (!authroleatt.roles.contains(currentuserinfo.role)) { filtercontext.result = view("nopermission", "_layout", "您没有权限访问此功能!"); } } //这里是记log用 protected override void onactionexecuted(actionexecutedcontext filtercontext) { base.onactionexecuted(filtercontext); var msg = $"用户: {currentuserinfo?.username}, 链接: {request.url}"; if (request.httpmethod == "post") msg += $", 数据: {httputility.urldecode(request.form.tostring())}"; //log.debug(msg); } }
admincontroller继承basecontroller
[authorize] public actionresult index() { return view(db.users.tolist()); } [authorize, authorizerole(role.管理员)] public actionresult details(int? id) { if (id == null) { return new httpstatuscoderesult(httpstatuscode.badrequest); } user user = db.users.find(id); if (user == null) { return httpnotfound(); } return view(user); }
登录页面:
@model userproject.viewmodels.account @{ viewbag.title = "login"; } @using (html.beginform("login", "admin",formmethod.post, new { @class = "form-horizontal", role = "form" })) { @html.antiforgerytoken() <hr /> @html.validationsummary(true, "", new { @class = "text-danger" }) <div class="form-group"> @html.labelfor(m => m.name, new { @class = "col-md-2 control-label" }) <div class="col-md-10"> @html.textboxfor(m => m.name, new { @class = "form-control" }) @html.validationmessagefor(m => m.name, "", new { @class = "text-danger" }) </div> </div> <div class="form-group"> @html.labelfor(m => m.password, new { @class = "col-md-2 control-label" }) <div class="col-md-10"> @html.passwordfor(m => m.password, new { @class = "form-control" }) @html.validationmessagefor(m => m.password, "", new { @class = "text-danger" }) </div> </div> <div class="form-group"> <div class="col-md-offset-2 col-md-10"> <input type="submit" value="登录" class="btn btn-primary" /> </div> </div> }
登录的action:
[allowanonymous] public actionresult login() { return view(); } [httppost, allowanonymous] public actionresult login(account model) { if (modelstate.isvalid) { var user = db.users.singleordefault(t => t.username == model.name && t.password == model.password); if (user != null) { formsauthentication.setauthcookie(model.name, false);//将用户名放入cookie中 return redirecttoaction("index"); } else { modelstate.addmodelerror("name", "用户名不存在!"); } } return view(model); } public actionresult logoff() { formsauthentication.signout(); return redirecttoaction("login"); }
按照以上方式 访问details这个action的时候必须是管理员角色。
以上所述是小编给大家介绍的基于mvc5+ef6+bootstrap框架实现身份验证和权限管理,希望对大家有所帮助
上一篇: c#通用登录模块分享