SSO的踢人模式/禁入模式
踢人模式
思路：
demo 数据
public class SampleData { public static List<UserlLogin> users; public static List<Role> roles; public static List<RoleWithControllerAction> rolewithControllaction; static SampleData() { // 初始化用户 users = new List<UserlLogin>() { new UserlLogin(){ Id=1, UserName="wangjie",UserPass="wangjie", RoleId=1,RememberMe=false}, new UserlLogin(){ Id=2, UserName ="senior1",UserPass="senior1", RoleId=2,RememberMe=false}, new UserlLogin(){ Id=3, UserName ="senior2",UserPass="senior2", RoleId=2,RememberMe=false}, new UserlLogin(){ Id=5, UserName="junior1",UserPass="junior1", RoleId=3,RememberMe=false}, new UserlLogin(){ Id=6, UserName="junior2",UserPass="junior2", RoleId=3,RememberMe=false}, new UserlLogin(){ Id=6, UserName="junior3",UserPass="junior3", RoleId=3,RememberMe=false} }; // 初始化角色 roles = new List<Role>() { new Role() { Id=1, RoleName="管理员", Description="管理员角色"}, new Role() { Id=2, RoleName="高级会员", Description="高级会员角色"}, new Role() { Id=3, RoleName="初级会员", Description="初级会员角色"} }; // 初始化角色控制器和Action对应类 rolewithControllaction = new List<RoleWithControllerAction>() { new RoleWithControllerAction(){ Id=1, ControllerName="AuthFilters", ActionName="AdminUser", RoleIds="1"}, new RoleWithControllerAction(){ Id=2, ControllerName="AuthFilters", ActionName="SeniorUser", RoleIds="1,2"}, new RoleWithControllerAction(){ Id=3, ControllerName="AuthFilters", ActionName="JuniorUser", RoleIds="1,2,3"}, new RoleWithControllerAction(){ Id=4, ControllerName="ActionFilters", ActionName="Index", RoleIds="2,3"} }; } }
public class Role { public int Id { get; set; } public string RoleName { get; set; } public string Description { get; set; } }
public class RoleWithControllerAction { public int Id { get; set; } public string ControllerName { get; set; } public string ActionName { get; set; } public string RoleIds { get; set; } }
public class UserlLogin { public int Id { get; set; } public string UserName { get; set; } public string UserPass { get; set; } public int RoleId { get; set; } public bool RememberMe { get; set; } }
实现登录模块
[HttpGet] public ActionResult Login() { if (Request["SSO"] != null && Request["SSO"].ToString() == "1") { ViewBag.Message = "对不起，别处有您帐号登录，您此处被迫下线！"; } var user = new UserlLogin(); return View(user); } [HttpPost] public ActionResult Login(UserlLogin users) { string userName = users.UserName; string userpass = users.UserPass; var dataUser = SampleData.users.Find(u => u.UserName == userName); if (dataUser != null) { if (dataUser.UserPass.Equals(userpass)) { Session["User"] = dataUser; if (users.RememberMe) FormsAuthentication.SetAuthCookie(users.UserName, true); //2880分钟有效期的cookie else FormsAuthentication.SetAuthCookie(users.UserName, false); //会话cookie return RedirectToAction("Register", "RegisterUser"); //return RedirectToAction("Welcome", "Home"); } else { TempData["Message"] = "密码错误！"; return RedirectToAction("Login"); } } else { ViewBag.Message = "用户不存在！"; return RedirectToAction("Login"); } } public ActionResult LogOut() { Session.Abandon(); FormsAuthentication.SignOut(); return RedirectToAction("Login"); }
实现用户注册模块
public ActionResult Register() { var user = Session["User"] as UserlLogin;//获取Session中登录的用户对象 var username = user.UserName; HttpContext httpContext = System.Web.HttpContext.Current; Hashtable userOnline = (Hashtable)httpContext.Application["Online"];//获取Application中的登录记录表 if (userOnline != null) { //遍历Application中的登录记录表 如果用户名相同，说明登录过，则做标记 IDictionaryEnumerator ide = userOnline.GetEnumerator(); while (ide.MoveNext()) { if (ide.Value != null && ide.Value.ToString() == username) { userOnline[ide.Key] = "-1"; //标记为”-1“，就代表当前用户”身份过期“ break; } } } else { userOnline = new Hashtable(); } //记录此次登录用户，因为如果重复登录，会删除掉之前的，现在保留 userOnline[Session.SessionID] = username; //Application 写入一个要加锁，因为是全局变量共享的 httpContext.Application.Lock(); httpContext.Application["Online"] = userOnline; httpContext.Application.UnLock(); return RedirectToAction("Welcome", "Home"); }
实现验证模块：
public class SSOAuthorize : AuthorizeAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { Hashtable userOnline = (Hashtable)httpContext.Application["Online"]; if (userOnline != null) { var ide = userOnline.GetEnumerator(); if (userOnline.Count > 0) { while (ide.MoveNext()) { //判断登录时保存的Session是否与现在的Session相同 if (userOnline.Contains(httpContext.Session.SessionID)) { if (ide.Key != null && ide.Key.ToString() == httpContext.Session.SessionID) { if (ide.Value != null && ide.Value == "-1") { //说明该帐户已经被人重复登录 //把当前的这个Session所对应的用户”踢出“ userOnline.Remove(httpContext.Session.SessionID); httpContext.Application.Lock(); httpContext.Application["Online"] = userOnline; httpContext.Application.UnLock(); httpContext.Response.Redirect("/Account/Login?SSO=1", true); return false; } } } else { return false; } } } else return false; } return true; //return base.AuthorizeCore(httpContext); } }
加上对应的过滤器(其实可以写在一起，做个笔记就这样吧)
[Authorize] [SSOAuthorize] public ActionResult Welcome() { return View(); }
[UserAuthorize] [SSOAuthorize] public ActionResult AdminUser() { return View(); } [UserAuthorize] [SSOAuthorize] public ActionResult SeniorUser() { return View(); } [UserAuthorize] [SSOAuthorize] public ActionResult JuniorUser() { return View(); }
在Global.asax中加入以事件
protected void Session_End(object sender, EventArgs e) { Hashtable useronLine = (Hashtable)Application["Online"]; if (useronLine != null) { if (useronLine[Session.SessionID] != null) { useronLine.Remove(Session.SessionID); Application.Lock(); Application["Online"] = useronLine; Application.UnLock(); } } }
禁入模式
构Global.asax加入Session_Start事件
protected void Session_Start(object sender, EventArgs e) { Hashtable useronLine = (Hashtable)Application["Online"]; if (useronLine == null) { useronLine = new Hashtable(); } useronLine[Session.SessionID] = "Anonymous"; Application.Lock(); Application["Online"] = useronLine; Application.UnLock(); }
禁入模式控制器
protected override bool AuthorizeCore(HttpContextBase httpContext) { Hashtable userOnline = (Hashtable)httpContext.Application["Online"]; var user = httpContext.Session["User"] as UserlLogin; var username = user.UserName; if (userOnline != null) { if (userOnline.Count > 0) { var ide = userOnline.GetEnumerator(); while (ide.MoveNext()) { //说明不是同一个用户 if (ide.Key != null && ide.Key.ToString() != httpContext.Session.SessionID) { if (ide.Value != null && ide.Value.Equals(username)) { httpContext.Response.Redirect("/Account/Login?SSO=1", true); return false; } } } } else return false; } return true; //return base.AuthorizeCore(httpContext); }
登录之后的注册模块
[SSOForbid] public ActionResult Register() { var user = Session["User"] as UserlLogin;//获取Session中登录的用户对象 var username = user.UserName; HttpContext httpContext = System.Web.HttpContext.Current; Hashtable userOnline = (Hashtable)httpContext.Application["Online"];//获取Application中的登录记录表 //记录此次登录用户，因为如果重复登录，会删除掉之前的，现在保留 userOnline[Session.SessionID] = username; //Application 写入一个要加锁，因为是全局变量共享的 httpContext.Application.Lock(); httpContext.Application["Online"] = userOnline; httpContext.Application.UnLock(); return RedirectToAction("Welcome", "Home"); }