asp.net-mvc 使用 web.config 在 MVC 中关闭身份验证
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/9880154/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Turn off Authentication in MVC using web.config
提问by mutex
I have an MVC site, secured using [Authorize] attributes, but have an issue on a production website that uses Single Sign On accross a couple or sites on different servers. I want to rule Authentication out as the cause; is there a way to temporarily turn off the Authentication through web.config so that all or some Controller Actions that have the Authorize Attribute can be accessed without logging in?
我有一个 MVC 站点，使用 [Authorize] 属性进行保护，但在生产网站上遇到问题，该网站在不同服务器上的几个或多个站点上使用单点登录。我想排除身份验证的原因；有没有办法通过 web.config 暂时关闭身份验证，以便无需登录即可访问所有或某些具有授权属性的控制器操作？
EDIT:
编辑：
I have tried adding the following to web.config:
我曾尝试将以下内容添加到 web.config：
<authentication mode="None" />
But this causes all actions decorated with Authorize Attribute to render blank pages. Actions without Authorize continue to work though
但这会导致所有使用授权属性修饰的操作呈现空白页面。未经授权的操作继续有效
回答by Erik Philips
is there a way to temporarily turn off the Authentication through web.config so that all or some Controller Actions that have the Authorize Attribute can be accessed without logging in?
有没有办法通过 web.config 暂时关闭身份验证，以便无需登录即可访问所有或某些具有授权属性的控制器操作？
No, this is not possible with the default framework. I'm pretty sure the AuthorizeAttributein MVC source code will attempt to check and see if the user is logged in. Without an authenticated user, access would be denied.
不，这在默认框架中是不可能的。我很确定AuthorizeAttributeMVC 源代码将尝试检查并查看用户是否已登录。如果没有经过身份验证的用户，访问将被拒绝。
回答by Luke
Use [AllowAnonymous] to allow specific actions in a controller be used by unauthorized users.
使用 [AllowAnonymous] 允许未经授权的用户使用控制器中的特定操作。
回答by Cyrus
In your Web.config comment out the child:
在您的 Web.config 中注释掉孩子：
<authentication mode="Windows" />
<authorization>
<!--<deny users="?" />-->
</authorization>
回答by Michael Freeman
You can allow all users access to the system by adding the following in the web.config. When the controller checks the authorization the user will be verified since you are letting all users with any windows authentication access the system.
您可以通过在 web.config 中添加以下内容来允许所有用户访问系统。当控制器检查授权时，用户将得到验证，因为您让所有具有任何 Windows 身份验证的用户访问系统。
<authentication mode="Windows" />
<authorization>
<allow users="*"/>
<!--<deny users="?" />-->
</authorization>
