ASP.NET 网站的自定义登录机制

我正在开发一个 ASP.NET 网站，我需要摆脱一些自定义但简单的登录机制。我从著名的员工信息入门套件 http://eisk.codeplex.com/

这是我到目前为止所拥有的：

在 ASP.NET 页面上：

protected void ButtonLogOn_Click(object sender, EventArgs e)
{
    if (String.IsNullOrEmpty(txtUserName.Value) || String.IsNullOrEmpty(txtPassword.Value))
        labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
    else
    {
        //if the log-in is successful
        LoginPage LoginBack = new LoginPage();

        if (LoginBack.VerifyCredentials(txtUserName.Value, txtPassword.Value) == 0)
        {
            SiteLogin.PerformAuthentication(txtUserName.Value, checkBoxRemember.Checked);
        }
        else
        {
            labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("<strong>Login Failed!</strong><hr/>The username and/or password you entered do not belong to any User account on our system.<br/>You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
        }
    }
}

protected void ButtonAdminLogOn_Click(object sender, EventArgs e)
{
    if (String.IsNullOrEmpty(txtUserName.Value) || String.IsNullOrEmpty(txtPassword.Value))
        labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("<strong>Login Please!</strong><hr/>You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
    else
    {
        //if the log-in is successful
        if (txtUserName.Value == "admin" && txtPassword.Value == "123123")
        {
            SiteLogin.PerformAdminAuthentication("admin", checkBoxRemember.Checked);
        }
        else
        {
            labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("<strong>Login Failed!</strong><hr/>The username and/or password you entered do not belong to any Administrator ccount on our system.<br/>You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
        }
    }
}

和一个实用程序类

public static void PerformAuthentication(string userName, bool remember)
{
    FormsAuthentication.RedirectFromLoginPage(userName, remember);

    if (HttpContext.Current.Request.QueryString["ReturnUrl"] == null)
    {
        RedirectToDefaultPage();
    }
    else
    {
        HttpContext.Current.Response.Redirect(HttpContext.Current.Request.QueryString["ReturnUrl"]);
    }
}

public static void PerformAdminAuthentication(string userName, bool remember)
{
    FormsAuthentication.RedirectFromLoginPage(userName, remember);

    if (HttpContext.Current.Request.QueryString["ReturnUrl"] == null)
    {
        RedirectToAdminDefaultPage();
    }
    else
    {
        HttpContext.Current.Response.Redirect(HttpContext.Current.Request.QueryString["ReturnUrl"]);
    }
}

我的登录表单有两个按钮： 管理员登录是硬编码的名称/密码。正常的登录例程返回到另一个程序集，该程序集调用 Web 服务并根据域登录检查用户名和密码。

现在，还有另一个包含代码的文件让我感到困惑。

全局.asax

<script RunAt="server">
protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
    if (HttpContext.Current.User != null)
    {
        if (HttpContext.Current.User.Identity.IsAuthenticated)
        {
            if (HttpContext.Current.User.Identity.AuthenticationType != "Forms")
            {
                throw new InvalidOperationException("Only forms authentication is supported, not " +
                        HttpContext.Current.User.Identity.AuthenticationType);
            }

            IIdentity userId = HttpContext.Current.User.Identity;

            //if role info is already NOT loaded into cache, put the role info in cache
            if (HttpContext.Current.Cache[userId.Name] == null)
            {
                string[] roles;

                if (userId.Name == "admin")
                {
                    roles = new string[1] { "administrators" };
                }
                else if (userId.Name == "member1")
                {
                    roles = new string[1] { "employees" };
                }
                else
                {
                    roles = new string[1] { "public" };
                }

                //1 hour sliding expiring time. Adding the roles in cache. 
                //This will be used in Application_AuthenticateRequest event located in Global.ascx.cs 
                //file to attach user Principal object.
                HttpContext.Current.Cache.Add(userId.Name, roles, null, DateTime.MaxValue, TimeSpan.FromHours(1), CacheItemPriority.BelowNormal, null);
            }

            //now assign the user role in the current security context
            HttpContext.Current.User = new GenericPrincipal(userId, (string[])HttpContext.Current.Cache[userId.Name]);
        }
    }

}
</script>

该网站有一些允许免费访问的“关于”页面，但其余页面可供管理员或员工使用。我的管理员用户名/密码是固定的，但员工登录名以域格式输入，需要在目标域上进行验证（全部完成），然后设置员工角色。

我该如何在 Global.asax 文件的 Application_AuthenticateRequest 方法中执行此操作？

为不同的文件夹设置不同的身份验证模式（通过网页配置 http://msdn.microsoft.com/en-us/library/ms178683.aspx甚至只是IIS 管理单元 http://technet.microsoft.com/en-us/library/cc733010%28WS.10%29.aspx):

• 根匿名（关于页面）
• ~/Admin 区域的表单身份验证
• Windows/NTLM 用于 ~/Employers 区域

您也可以使用扩展登录控制 http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.aspx与定制会员提供者 http://msdn.microsoft.com/en-us/library/system.web.security.membership.aspx.