安全手柄已关闭'使用FederatedAuthentication.SessionAuthenticationM

接下来，我有一个自定义的授权过滤器属性，使用上面定义的customclaimstrtransformer类来使用自定义声明进行授权:

public class PROJClaimsAuthorizeAttribute : AuthorizeAttribute  {
    public string ClaimType { get; set; }
    public string ClaimValue { get; set; }
//Called when access is denied
protected override void HandleUnauthorizedRequest(System.Web.Mvc.AuthorizationContext filterContext)
{
    //User isn't logged in
    if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
    {
        filterContext.Result = new RedirectToRouteResult(
                new RouteValueDictionary(new { controller = "Home", action = "Index" })
        );
    }
    //User is logged in but has no access
    else
    {
        filterContext.Result = new RedirectToRouteResult(
                new RouteValueDictionary(new { controller = "Error", action = "AccessDenied" })
        );
    }
}
//Core authentication, called before each action
protected override bool AuthorizeCore(HttpContextBase context)
{
    SessionSecurityToken token;
    ClaimsIdentity claimsIdentity = null;
    ClaimsIdentity userClaimsIdentity = null;
    ClaimsPrincipal customClaimsPrinci = null;
    ClaimsAuthenticationManager authManager = null;
    var isAuthorized  = false;
    try
    {
        claimsIdentity = context.User.Identity as ClaimsIdentity; // get current user's ClaimsIdentity (Widnow's identity as  ClaimsIdentity)
        isAuthorized = base.AuthorizeCore(context);
        if (!context.Request.IsAuthenticated || !isAuthorized)
        {
            return false;
        }
        ///////******* THE Error Causing IF statement *******************************************
        //check if the SessionSecurityToken is available in cookie
        if (FederatedAuthentication.SessionAuthenticationModule.TryReadSessionTokenFromCookie(out token))
        {
            //var accessToken = await tokenManager.GetTokenFromStoreAsync(token.ClaimsPrincipal.Identity.Name);
            claimsIdentity = token.ClaimsPrincipal.Identity as ClaimsIdentity;
        }
        else
        {
            //else get the principal with Custom claims identity using CustomClaimsTransformer, which also sets it in cookie
            ClaimsPrincipal currentPrincipal = ClaimsPrincipal.Current;
            CustomClaimsTransformer customClaimsTransformer = new CustomClaimsTransformer();
            ClaimsPrincipal tranformedClaimsPrincipal = customClaimsTransformer.Authenticate(string.Empty, currentPrincipal);
            Thread.CurrentPrincipal = tranformedClaimsPrincipal;
            HttpContext.Current.User = tranformedClaimsPrincipal;
        }

        isAuthorized = checkClaimValidity(claimsIdentity, ClaimType, ClaimValue);
    }
    catch (Exception e)
    {
        // Error handling code
       var exptnMsg = "error setting AuthorizeCore" + e.Message;
       return false;
    }
    return isAuthorized;
} // </ protected override bool AuthorizeCore >

//checks Claim type/value in the given Claims Identity
private Boolean checkClaimValidity(ClaimsIdentity pClaimsIdentity, string pClaimType, string pClaimValue)
{
    Boolean blnClaimsValiditiy = false;
    //now check the passed in Claimtype has the passed in Claimvalue
    if (pClaimType != null && pClaimValue != null)
    {
        if ((pClaimsIdentity.HasClaim(x => x.Type.ToLower() == pClaimType.ToLower() && x.Value.ToLower() == pClaimValue.ToLower())))
        {
            blnClaimsValiditiy = true;
        }
    }
    return blnClaimsValiditiy;
 }
}

在此之后，我可以用我的自定义授权属性'PROJClaimsAuthorizeAttribute'装饰我的控制器类，如下所示: