我有一個(gè) dotnet core 2.2 api，其中包含一些控制器和操作方法，需要根據(jù)用戶聲明和正在訪問(wèn)的資源進(jìn)行授權(quán)?；旧?，每個(gè)用戶可以對(duì)每個(gè)資源擁有 0 個(gè)或多個(gè)“角色”。這一切都是使用 ASP.NET Identity Claims 完成的。所以，我的理解是我需要使用Resource-based authorization。但是這兩個(gè)例子大部分是相同的，并且在每個(gè)操作方法上都需要明確的命令式 if/else 邏輯，這是我試圖避免的。我希望能夠做類似的事情[Authorize("Admin")] // or something similarpublic async Task<IActionResult> GetSomething(int resourceId){ var resource = await SomeRepository.Get(resourceId); return Json(resource);}在其他地方將授權(quán)邏輯定義為策略/過(guò)濾器/要求/任何東西，并可以訪問(wèn)當(dāng)前用戶聲明和resourceId端點(diǎn)接收的參數(shù)。所以我可以看到用戶是否有一個(gè)聲明，表明他擁有該特定resourceId.
3 回答
米脂
TA貢獻(xiàn)1836條經(jīng)驗(yàn) 獲得超3個(gè)贊
編輯：根據(jù)反饋使其動(dòng)態(tài)化
RBAC 和 .NET 中的聲明的關(guān)鍵是創(chuàng)建您的 ClaimsIdentity，然后讓框架完成它的工作。下面是一個(gè)示例中間件，它將查看查詢參數(shù)“user”，然后根據(jù)字典生成 ClaimsPrincipal。
為了避免實(shí)際連接到身份提供者的需要，我創(chuàng)建了一個(gè)中間件來(lái)設(shè)置 ClaimsPrincipal：
// **THIS CLASS IS ONLY TO DEMONSTRATE HOW THE ROLES NEED TO BE SETUP **
public class CreateFakeIdentityMiddleware
{
private readonly RequestDelegate _next;
public CreateFakeIdentityMiddleware(RequestDelegate next)
{
_next = next;
}
private readonly Dictionary<string, string[]> _tenantRoles = new Dictionary<string, string[]>
{
["tenant1"] = new string[] { "Admin", "Reader" },
["tenant2"] = new string[] { "Reader" },
};
public async Task InvokeAsync(HttpContext context)
{
// Assume this is the roles
List<Claim> claims = new List<Claim>
{
new Claim(ClaimTypes.Name, "John"),
new Claim(ClaimTypes.Email, "john@someemail.com")
};
foreach (KeyValuePair<string, string[]> tenantRole in _tenantRoles)
{
claims.AddRange(tenantRole.Value.Select(x => new Claim(ClaimTypes.Role, $"{tenantRole.Key}:{x}".ToLower())));
}
// Note: You need these for the AuthorizeAttribute.Roles
claims.AddRange(_tenantRoles.SelectMany(x => x.Value)
.Select(x => new Claim(ClaimTypes.Role, x.ToLower())));
context.User = new System.Security.Claims.ClaimsPrincipal(new ClaimsIdentity(claims,
"Bearer"));
await _next(context);
}
}
要連接起來(lái)，只需在啟動(dòng)類中使用IApplicationBuilder的UseMiddleware擴(kuò)展方法。
app.UseMiddleware<RBACExampleMiddleware>();
我創(chuàng)建了一個(gè) AuthorizationHandler，它將查找查詢參數(shù)“租戶”，并根據(jù)角色成功或失敗。
public class SetTenantIdentityHandler : AuthorizationHandler<TenantRoleRequirement>
{
public const string TENANT_KEY_QUERY_NAME = "tenant";
private static readonly ConcurrentDictionary<string, string[]> _methodRoles = new ConcurrentDictionary<string, string[]>();
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TenantRoleRequirement requirement)
{
if (HasRoleInTenant(context))
{
context.Succeed(requirement);
}
return Task.CompletedTask;
}
private bool HasRoleInTenant(AuthorizationHandlerContext context)
{
if (context.Resource is AuthorizationFilterContext authorizationFilterContext)
{
if (authorizationFilterContext.HttpContext
.Request
.Query
.TryGetValue(TENANT_KEY_QUERY_NAME, out StringValues tenant)
&& !string.IsNullOrWhiteSpace(tenant))
{
if (TryGetRoles(authorizationFilterContext, tenant.ToString().ToLower(), out string[] roles))
{
if (context.User.HasClaim(x => roles.Any(r => x.Value == r)))
{
return true;
}
}
}
}
return false;
}
private bool TryGetRoles(AuthorizationFilterContext authorizationFilterContext,
string tenantId,
out string[] roles)
{
string actionId = authorizationFilterContext.ActionDescriptor.Id;
roles = null;
if (!_methodRoles.TryGetValue(actionId, out roles))
{
roles = authorizationFilterContext.Filters
.Where(x => x.GetType() == typeof(AuthorizeFilter))
.Select(x => x as AuthorizeFilter)
.Where(x => x != null)
.Select(x => x.Policy)
.SelectMany(x => x.Requirements)
.Where(x => x.GetType() == typeof(RolesAuthorizationRequirement))
.Select(x => x as RolesAuthorizationRequirement)
.SelectMany(x => x.AllowedRoles)
.ToArray();
_methodRoles.TryAdd(actionId, roles);
}
roles = roles?.Select(x => $"{tenantId}:{x}".ToLower())
.ToArray();
return roles != null;
}
}
TenantRoleRequirement 是一個(gè)非常簡(jiǎn)單的類：
public class TenantRoleRequirement : IAuthorizationRequirement { }
然后像這樣在 startup.cs 文件中連接所有內(nèi)容：
services.AddTransient<IAuthorizationHandler, SetTenantIdentityHandler>();
// Although this isn't used to generate the identity, it is needed
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.Audience = "https://localhost:5000/";
options.Authority = "https://localhost:5000/identity/";
});
services.AddAuthorization(authConfig =>
{
authConfig.AddPolicy(Policies.HasRoleInTenant, policyBuilder => {
policyBuilder.RequireAuthenticatedUser();
policyBuilder.AddRequirements(new TenantRoleRequirement());
});
});
該方法如下所示：
// TOOD: Move roles to a constants/globals
[Authorize(Policy = Policies.HasRoleInTenant, Roles = "admin")]
[HttpGet]
public ActionResult<IEnumerable<string>> Get()
{
return new string[] { "value1", "value2" };
}
以下是測(cè)試場(chǎng)景：
正：https://localhost:44337/api/values?tenant=tenant1
否定：https://localhost:44337/api/values?tenant=tenant2
否定：https://localhost:44337/api/values
這種方法的關(guān)鍵是我從未實(shí)際返回 403。代碼設(shè)置身份，然后讓框架處理結(jié)果。這確保身份驗(yàn)證與授權(quán)分開(kāi)。
繁華開(kāi)滿天機(jī)
TA貢獻(xiàn)1816條經(jīng)驗(yàn) 獲得超4個(gè)贊
您可以創(chuàng)建自己的屬性來(lái)檢查用戶的角色。我在我的一個(gè)應(yīng)用程序中這樣做了：
public sealed class RoleValidator : Attribute, IAuthorizationFilter
{
private readonly IEnumerable<string> _roles;
public RoleValidator(params string[] roles) => _roles = roles;
public RoleValidator(string role) => _roles = new List<string> { role };
public void OnAuthorization(AuthorizationFilterContext filterContext)
{
if (filterContext.HttpContext.User.Claims == null || filterContext.HttpContext.User.Claims?.Count() <= 0)
{
filterContext.Result = new UnauthorizedResult();
return;
}
if (CheckUserRoles(filterContext.HttpContext.User.Claims))
return;
filterContext.Result = new ForbidResult();
}
private bool CheckUserRoles(IEnumerable<Claim> claims) =>
JsonConvert.DeserializeObject<List<RoleDto>>(claims.FirstOrDefault(x => x.Type.Equals(ClaimType.Roles.ToString()))?.Value)
.Any(x => _roles.Contains(x.Name));
}
它從聲明中獲取用戶角色，并檢查用戶是否具有獲取此資源的適當(dāng)角色。你可以像這樣使用它：
[RoleValidator("Admin")]
或更好的枚舉方法：
[RoleValidator(RoleType.Admin)]
或者您可以傳遞多個(gè)角色：
[RoleValidator(RoleType.User, RoleType.Admin)]
對(duì)于此解決方案，您還必須使用標(biāo)準(zhǔn)授權(quán)屬性。
德瑪西亞99
TA貢獻(xiàn)1770條經(jīng)驗(yàn) 獲得超3個(gè)贊
根據(jù)評(píng)論編輯
根據(jù)我的理解，您想訪問(wèn)當(dāng)前用戶（所有相關(guān)信息）、您要為控制器（或操作）指定的角色以及端點(diǎn)接收的參數(shù)。還沒(méi)有嘗試過(guò) web api，但對(duì)于 asp.net core MVC，您可以通過(guò)AuthorizationHandler在基于策略的授權(quán)中使用并結(jié)合專門(mén)創(chuàng)建的注入服務(wù)來(lái)確定角色資源訪問(wèn)來(lái)實(shí)現(xiàn)這一點(diǎn)。
為此，首先在以下位置設(shè)置政策Startup.ConfigureServices：
services.AddAuthorization(options =>
{
options.AddPolicy("UserResource", policy => policy.Requirements.Add( new UserResourceRequirement() ));
});
services.AddScoped<IAuthorizationHandler, UserResourceHandler>();
services.AddScoped<IRoleResourceService, RoleResourceService>();
接下來(lái)創(chuàng)建UserResourceHandler：
public class UserResourceHandler : AuthorizationHandler<UserResourceRequirement>
{
readonly IRoleResourceService _roleResourceService;
public UserResourceHandler (IRoleResourceService r)
{
_roleResourceService = r;
}
protected override async Task HandleRequirementAsync(AuthorizationHandlerContext authHandlerContext, UserResourceRequirement requirement)
{
if (context.Resource is AuthorizationFilterContext filterContext)
{
var area = (filterContext.RouteData.Values["area"] as string)?.ToLower();
var controller = (filterContext.RouteData.Values["controller"] as string)?.ToLower();
var action = (filterContext.RouteData.Values["action"] as string)?.ToLower();
var id = (filterContext.RouteData.Values["id"] as string)?.ToLower();
if (_roleResourceService.IsAuthorize(area, controller, action, id))
{
context.Succeed(requirement);
}
}
}
}
訪問(wèn)端點(diǎn)接收到的參數(shù)是通過(guò)轉(zhuǎn)換context.Resource為 來(lái)實(shí)現(xiàn)的AuthorizationFilterContext，這樣我們就可以RouteData從它訪問(wèn)。至于UserResourceRequirement，我們可以留空。
public class UserResourceRequirement : IAuthorizationRequirement { }
至于IRoleResourceService，它是一個(gè)普通的服務(wù)類，因此我們可以向它注入任何東西。此服務(wù)是將角色與代碼中的動(dòng)作配對(duì)的替代品，因此我們無(wú)需在動(dòng)作的屬性中指定它。這樣，我們就可以自由選擇實(shí)現(xiàn)方式，例如：來(lái)自數(shù)據(jù)庫(kù)、來(lái)自配置文件或硬編碼。
訪問(wèn)用戶RoleResourceService是通過(guò)注入實(shí)現(xiàn)的IHttpContextAccessor。請(qǐng)注意，要使IHttpContextAccessor可注射，請(qǐng)services.AddHttpContextAccessor()在Startup.ConfigurationServices方法體中添加。
這是從配置文件獲取信息的示例：
public class RoleResourceService : IRoleResourceService
{
readonly IConfiguration _config;
readonly IHttpContextAccessor _accessor;
readonly UserManager<AppUser> _userManager;
public class RoleResourceService(IConfiguration c, IHttpContextAccessor a, UserManager<AppUser> u)
{
_config = c;
_accessor = a;
_userManager = u;
}
public bool IsAuthorize(string area, string controller, string action, string id)
{
var roleConfig = _config.GetValue<string>($"RoleSetting:{area}:{controller}:{action}"); //assuming we have the setting in appsettings.json
var appUser = await _userManager.GetUserAsync(_accessor.HttpContext.User);
var userRoles = await _userManager.GetRolesAsync(appUser);
// all of needed data are available now, do the logic of authorization
return result;
}
}
從數(shù)據(jù)庫(kù)中獲取設(shè)置肯定有點(diǎn)復(fù)雜，但它可以完成，因?yàn)槲覀兛梢宰⑷階ppDbContext。對(duì)于硬編碼方法，有很多方法可以做到。
完成所有操作后，對(duì)操作使用策略：
[Authorize(Policy = "UserResource")] //dont need Role name because of the RoleResourceService
public ActionResult<IActionResult> GetSomething(int resourceId)
{
//existing code
}
事實(shí)上，我們可以對(duì)我們想要應(yīng)用的任何操作使用“UserResource”策略。
- 3 回答
- 0 關(guān)注
- 175 瀏覽
添加回答
舉報(bào)
0/150
提交
取消