自定义StringLength验证不起作用

Question

我在项目中添加了Customized StringLength类

using System;
using System.ComponentModel.DataAnnotations;

namespace Argussoft.BI.DAL.Validation
{
public class PasswordLengthAttribute : StringLengthAttribute
{
    public PasswordLengthAttribute(int maximumLength)
        : base(maximumLength)
    {
    }

    public override bool IsValid(object value)
    {
        string val = Convert.ToString(value);
        if (val.Length < MinimumLength)
            ErrorMessage = "Минимальная длина пароля 5 символов";
        if (val.Length > MaximumLength)
            ErrorMessage = "Максимальная длина пароля 20 символов";
        return base.IsValid(value);
    }
}
}

这是我的班级CreateUserDto

public class CreateUserDto
    {
      [Required(ErrorMessage = "Введите пароль")]
        [PasswordLength(User.PasswordMaxLength, MinimumLength = User.PasswordMinLength)]
        [RegularExpression(User.PasswordRegularExpression, ErrorMessage = "Пароль может содержать только латинские символы, дефисы, подчеркивания, точки")]
        public virtual String Password { get; set; }
    }

它是我的控制者

[HttpPost]
    public ActionResult CreateUser(CreateUserDto dto)
    {
        if (!Request.IsAjaxRequest()) return View("_AddUserDialog", dto);
        if (!ModelState.IsValid) {FillViewBags(); return PartialView("_AddUserDialog", dto);}
        string hash;
        string salt;
        CryptoUtils.SetHashAndSalt(dto.Password, out hash, out salt);
        UserService.CreateUser(
            new User ()
            {
                Name = dto.Name,
                Email = dto.Email,
                FullName = dto.FullName,
                Role = UserService.SetRole(dto.Role),
                Phone = dto.Phone,
                Status = UserService.SetUserStatus(dto.Status),
                PasswordHash = hash,
                PasswordSalt = salt
            });
        return Json(new { Message = string.Format("Пользователь {0} успешно создан", dto.Name) });
    }

但如果我尝试输入密码小于5个字符或大于20个，ModelState.IsValid == false，但 当密码少于5个字符或超过20个字符时，我不会收到任何错误消息。