MVC 基于FormsAuthentication 方式的权限验证

1.登录的代码

[HttpPost]
        public ActionResult Index(User entity)
        {
            User user = GetUser(entity.Name, entity.Password);
            if (user != null)
            {
                FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                            1,
                            user.UserID.ToString(),
                            DateTime.Now,
                            DateTime.Now.AddMinutes(30),
                            false,
                            user.RoleNames.XJoin(","));
                string encTicket = FormsAuthentication.Encrypt(authTicket);
                HttpCookie cookie = HttpContext.Request.Cookies[FormsAuthentication.FormsCookieName];
                if (cookie == null)
                {
                    cookie = new HttpCookie(FormsAuthentication.FormsCookieName);
                }
                cookie.Value = encTicket;
                HttpContext.Response.AppendCookie(cookie);
                return RedirectToAction("Index", "Test");
            }
            return View();
        }

FormsAuthenticationTicket的user.RoleNames.XJoin(",")是我自己写的扩展方法，表示用","分隔开的字符串。
生成票据

2.Global.asax中的代码

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
        {
            if (HttpContext.Current.User != null)
            {
                if (HttpContext.Current.User.Identity.IsAuthenticated)
                {
                    if (HttpContext.Current.User.Identity is FormsIdentity)
                    {
                        FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;
                        FormsAuthenticationTicket ticket = id.Ticket;
                        string userData = ticket.UserData;

                        string[] roles = userData.Split(',');
                        HttpContext.Current.User = new GenericPrincipal(id, roles);
                    }
                }
            }
        }

给用户票据的时候在里面加了一个字符串的角色信息，比如“Administrator”，当一个请求过来的时候asp.net会有一个Application_AuthenticateRequest的事件，专门用于用户认证授权，在这个事件中我们只需要将这个字符表达的角色重建给用户就可以，我们在Global.asax的Application_AuthenticateRequest方法中增加如下代码

3.Controller中的代码

    [Authorize(Roles="sysadmin")]
    public class TestController : Controller
    {
        public ActionResult Index()
        {
            return View();
        }
    }

Roles参数可以包含多个Role，比如（[Authorize(Roles="sysadmin,conadmin")]），Authorize属性页可以具体控制到某个action，只需要将其写到对应Action方法的属性上即可。

4.webConfig中的代码

<authentication mode="Forms">
      <forms loginUrl="~/Login/Index" timeout="2880" />
</authentication>