基于角色(Role-Based)的表单验证

要求:
using System.Web.Security
using System.Security.Principal

[Principal]:主要的(这里怎样翻译呢??)
==================================

+admin1

-default.aspx
基于角色(Role-Based)的表单验证

-web.config //web.config#1
基于角色(Role-Based)的表单验证

+admin2

-default.aspx
基于角色(Role-Based)的表单验证

-web.config//web.config#2
基于角色(Role-Based)的表单验证

+bin

-web.config//web.config#root
基于角色(Role-Based)的表单验证

-login.aspx

==========================
目的:
admin1文件夹:只有role是administrator可以访问.
admini2文件夹:只有role是controler可以访问.

帐号,密码,角色存储在特定数据库中.

本例目的(其他道理相同):
caca是administrator
wawa是controler
所以caca可以访问admin1,不能访问admin2;wawa反之.

==========================
配置:
(1)web.config#root

<?xml version="1.0" encoding="utf-8"?>
基于角色(Role-Based)的表单验证

<configuration>
基于角色(Role-Based)的表单验证

<system.web>
基于角色(Role-Based)的表单验证

<authentication mode="Forms">
基于角色(Role-Based)的表单验证

<forms name="authenticationcookie"
loginUrl="login.aspx" protection="All" path="/" timeout="40"/>
基于角色(Role-Based)的表单验证

</authentication>
基于角色(Role-Based)的表单验证

</system.web>
基于角色(Role-Based)的表单验证

</configuration>
基于角色(Role-Based)的表单验证

(2)web.config#1

<?xml version="1.0" encoding="utf-8"?>
基于角色(Role-Based)的表单验证

<configuration>
基于角色(Role-Based)的表单验证

<system.web>
基于角色(Role-Based)的表单验证

<authorization>
基于角色(Role-Based)的表单验证

<allow roles="administrator"/>
基于角色(Role-Based)的表单验证

<deny users="*"/>
基于角色(Role-Based)的表单验证

</authorization>
基于角色(Role-Based)的表单验证

</system.web>
基于角色(Role-Based)的表单验证

</configuration>
基于角色(Role-Based)的表单验证

(3)web.config#2

<?xml version="1.0" encoding="utf-8"?>
基于角色(Role-Based)的表单验证

<configuration>
基于角色(Role-Based)的表单验证

<system.web>
基于角色(Role-Based)的表单验证

<authorization>
基于角色(Role-Based)的表单验证

<allow roles="controler"/>
基于角色(Role-Based)的表单验证

<deny users="*"/>
基于角色(Role-Based)的表单验证

</authorization>
基于角色(Role-Based)的表单验证

</system.web>
基于角色(Role-Based)的表单验证

</configuration>
基于角色(Role-Based)的表单验证

==========================
关键代码:
(1)login.aspx

private void signin(Object sender,EventArgs e)
HttpCookie(FormsAuthentication.FormsCookieName,encryptedTicket);

//在保存这个Cookie之前,需要设定它的有效时间

//authCookie.Expires=DateTime.Now.AddDays(3);
基于角色(Role-Based)的表单验证

Response.Cookies.Add(authCookie);
基于角色(Role-Based)的表单验证

//返回所请求的URL
基于角色(Role-Based)的表单验证

Response.Redirect( FormsAuthentication.GetRedirectUrl(tbName.Text, false ));
基于角色(Role-Based)的表单验证

}

private void signout(Object sender,EventArgs e)

<html>

<head>

<title>LogIn</title>
基于角色(Role-Based)的表单验证

</head>

<body>

<form runat=server>
基于角色(Role-Based)的表单验证

Name:<asp:textbox runat=server id=tbName/>[caca/wawa]
基于角色(Role-Based)的表单验证

<asp:button runat=server text=LogIn onclick=signin/>
基于角色(Role-Based)的表单验证

<asp:button runat=server text=SignOut onclick=signout/>
基于角色(Role-Based)的表单验证

<hr>

<asp:label runat=server id=lblMessage/>
基于角色(Role-Based)的表单验证

</form>

</body>

</html>

(2)Global.asax

<% @ import namespace=System.Security.Principal %>
基于角色(Role-Based)的表单验证

<% @ import namespace=System.Security %>
基于角色(Role-Based)的表单验证

protected void Application_AuthenticateRequest(Object sender, EventArgs e)

===========================
参考:
(1)Building Secure Microsoft ASP.NET Applications:
Authentication, Authorization, and Secure Communication by Microsoft Corporation
ISBN:0735618909
Microsoft Press
(2)MSDN
===========================
下载参考代码