替换 Principal 对象

提供身份验证服务的应用程序必须能够为给定的线程替换 Principal 对象。 而且，安全系统必须帮助保护这种替换 Principal 对象的能力，这是因为恶意附加的、不正确的 Principal 会通过声明一个不真实的身份或角色危及应用程序的安全。 因此，必须将 System.Security.Permissions.SecurityPermission 对象授予需要能够替换 Principal 对象的应用程序，以使这些应用程序可以对主体进行控制。 （请注意，对于执行基于角色的安全检查或创建 Principal 对象而言，该权限不是必需的。）

通过执行下列任务可替换当前的 Principal 对象。

1. 创建要替入的 Principal 对象和关联的 Identity 对象。

2. 将新的 Principal 对象附加到调用上下文。

示例

下面的示例演示如何创建一般主体对象并用该对象来设置线程的主体。

Imports System
Imports System.Threading
Imports System.Security.Permissions
Imports System.Security.Principal



Class SecurityPrincipalDemo

    ' Create a generic principal based on values from the current
    ' WindowsIdentity.
    Private Shared Function GetGenericPrincipal() As GenericPrincipal
        ' Use values from the current WindowsIdentity to construct
        ' a set of GenericPrincipal roles.
        Dim windowsIdentity As WindowsIdentity = windowsIdentity.GetCurrent()
        Dim roles(9) As String
        If windowsIdentity.IsAuthenticated Then
            ' Add custom NetworkUser role.
            roles(0) = "NetworkUser"
        End If

        If windowsIdentity.IsGuest Then
            ' Add custom GuestUser role.
            roles(1) = "GuestUser"
        End If

        If windowsIdentity.IsSystem Then
            ' Add custom SystemUser role.
            roles(2) = "SystemUser"
        End If

        ' Construct a GenericIdentity object based on the current Windows
        ' identity name and authentication type.
        Dim authenticationType As String = windowsIdentity.AuthenticationType
        Dim userName As String = windowsIdentity.Name
        Dim genericIdentity As New GenericIdentity(userName, authenticationType)

        ' Construct a GenericPrincipal object based on the generic identity
        ' and custom roles for the user.
        Dim genericPrincipal As New GenericPrincipal(genericIdentity, roles)

        Return genericPrincipal

    End Function 'GetGenericPrincipal

    Public Shared Sub Main()
        ' Retrieve a GenericPrincipal that is based on the current user's
        ' WindowsIdentity.
        Dim genericPrincipal As GenericPrincipal = GetGenericPrincipal()

        ' Retrieve the generic identity of the GenericPrincipal object.
        Dim principalIdentity As GenericIdentity = CType(genericPrincipal.Identity, GenericIdentity)

        ' Display the identity name and authentication type.
        If principalIdentity.IsAuthenticated Then
            Console.WriteLine(principalIdentity.Name)
            Console.WriteLine("Type:" + principalIdentity.AuthenticationType)
        End If

        ' Verify that the generic principal has been assigned the
        ' NetworkUser role.
        If genericPrincipal.IsInRole("NetworkUser") Then
            Console.WriteLine("User belongs to the NetworkUser role.")
        End If

        Thread.CurrentPrincipal = genericPrincipal

    End Sub 'Main



End Class 'SecurityPrincipalDemo 

using System;
using System.Threading;
using System.Security.Permissions;
using System.Security.Principal;

class SecurityPrincipalDemo
{
    public static void Main()
    {
        // Retrieve a GenericPrincipal that is based on the current user's
        // WindowsIdentity.
        GenericPrincipal genericPrincipal = GetGenericPrincipal();

        // Retrieve the generic identity of the GenericPrincipal object.
        GenericIdentity principalIdentity =
            (GenericIdentity)genericPrincipal.Identity;

        // Display the identity name and authentication type.
        if (principalIdentity.IsAuthenticated)
        {
            Console.WriteLine(principalIdentity.Name);
            Console.WriteLine("Type:" + principalIdentity.AuthenticationType);
        }

        // Verify that the generic principal has been assigned the
        // NetworkUser role.
        if (genericPrincipal.IsInRole("NetworkUser"))
        {
            Console.WriteLine("User belongs to the NetworkUser role.");
        }

        Thread.CurrentPrincipal = genericPrincipal;

    }

    // Create a generic principal based on values from the current
    // WindowsIdentity.
    private static GenericPrincipal GetGenericPrincipal()
    {
        // Use values from the current WindowsIdentity to construct
        // a set of GenericPrincipal roles.
        WindowsIdentity windowsIdentity = WindowsIdentity.GetCurrent();
        string[] roles = new string[10];
        if (windowsIdentity.IsAuthenticated)
        {
            // Add custom NetworkUser role.
            roles[0] = "NetworkUser";
        }

        if (windowsIdentity.IsGuest)
        {
            // Add custom GuestUser role.
            roles[1] = "GuestUser";
        }

        if (windowsIdentity.IsSystem)
        {
            // Add custom SystemUser role.
            roles[2] = "SystemUser";
        }

        // Construct a GenericIdentity object based on the current Windows
        // identity name and authentication type.
        string authenticationType = windowsIdentity.AuthenticationType;
        string userName = windowsIdentity.Name;
        GenericIdentity genericIdentity =
            new GenericIdentity(userName, authenticationType);

        // Construct a GenericPrincipal object based on the generic identity
        // and custom roles for the user.
        GenericPrincipal genericPrincipal =
            new GenericPrincipal(genericIdentity, roles);

        return genericPrincipal;
    }

}

请参见

参考

System.Security.Permissions.SecurityPermission

概念

主体和标识对象