.Net Core Policy 基于策略授权
在ASP.NET Core中，重新设计了一种更加灵活的授权方式：基于策略的授权, 它是授权的核心.在使用基于策略的授权时，首先要定义授权策略，而授权策略本质上就是对Claims的一系列断言。基于角色的授权和基于Scheme的授权，只是一种语法上的便捷，最终都会生成授权策略。
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
services.AddAuthorization(options =>
{
//options.AddPolicy("Administrator", policy => policy.RequireRole("administrator"));
options.AddPolicy("Administrator", policy => policy.RequireClaim(ClaimTypes.Role, "administrator"));
//options.AddPolicy("Founders", policy => policy.RequireClaim("EmployeeNumber", "1", "2", "3", "4", "5"));
});
}
[Authorize(Policy = "Administrator")]
public ActionResult> GetValueByAdminPolicy()
{
return new string[] { "GetValueByAdminPolicy" };
}
自定义策略授权
基于策略的授权中有一个很重要的概念是Requirements，每一个Requirement都代表一个授权条件。Requirement需要继承接口IAuthorizationRequirement。
在 ASP.NET Core 中已经内置了一些常用的实现：
AssertionRequirement ：使用最原始的断言形式来声明授权策略。
DenyAnonymousAuthorizationRequirement ：用于表示禁止匿名用户访问的授权策略，并在AuthorizationOptions中将其设置为默认策略。
ClaimsAuthorizationRequirement ：用于表示判断Cliams中是否包含预期的Claims的授权策略。
RolesAuthorizationRequirement ：用于表示使用ClaimsPrincipal.IsInRole来判断是否包含预期的Role的授权策略。
NameAuthorizationRequirement：用于表示使用ClaimsPrincipal.Identities.Name来判断是否包含预期的Name的授权策略。
OperationAuthorizationRequirement：用于表示基于操作的授权策略。
除了OperationAuthorizationRequirement外，都有对应的快捷添加方法，比如RequireClaim，RequireRole，RequireUserName等。当内置的Requirement不能满足需求时，可以定义自己的Requirement。
下面演示自定义策略授权
Startup类配置
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthorization(options =>
{
options.AddPolicy("Permission", policy => policy.Requirements.Add(new PermissionRequirement()));
}).AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>
{
options.LoginPath = new PathString("/api/values/login");
});
services.AddTransient();
services.AddSingleton();
services.AddSingleton();
services.AddControllers();
}
Configure方法添加
app.UseAuthentication();
app.UseAuthorization();
新建类 PermissionRequirement
public class PermissionRequirement : IAuthorizationRequirement
{
}
新建类 PermissionHandler
public class PermissionHandler : AuthorizationHandler
{
private readonly IUserService _userService;
private readonly IHttpContextAccessor _accessor;
public PermissionHandler(IUserService userService, IHttpContextAccessor accessor)
{
_userService = userService;
_accessor = accessor;
}
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)
{
var httpContext = _accessor.HttpContext;
var isAuthenticated = httpContext.User.Identity.IsAuthenticated;
if (isAuthenticated)
{
Guid userId;
if (!Guid.TryParse(httpContext.User.Claims.SingleOrDefault(s => s.Type == "id").Value, out userId))
{
return Task.CompletedTask;
}
var functions = _userService.GetFunctionsByUserId(userId);
var requestUrl = httpContext.Request.Path.Value.ToLower();
if (functions != null && functions.Count > 0 && functions.Contains(requestUrl))
{
context.Succeed(requirement);
}
}
return Task.CompletedTask;
}
}
添加测试用户数据，项目中需从数据库读取
public static class TestUsers
{
public static List Users = new List
{
new User{ Id = Guid.NewGuid(), UserName = "Paul", Password = "Paul123", Roles = new List{ "administrator", "api_access" }, Urls = new List{ "/api/values/getadminvalue", "/api/values/getguestvalue" }},
new User{ Id = Guid.NewGuid(), UserName = "Young", Password = "Young123", Roles = new List{ "api_access" }, Urls = new List{ "/api/values/getguestvalue" }},
new User{ Id = Guid.NewGuid(), UserName = "Roy", Password = "Roy123", Roles = new List{ "administrator" }, Urls = new List{ "/api/values/getadminvalue" }},
};
}
public class User
{
public Guid Id { get; set; }
public string UserName { get; set; }
public string Password { get; set; }
public List Roles { get; set; }
public List Urls { get; set; }
}
添加UserService
public interface IUserService
{
List GetFunctionsByUserId(Guid id);
}
public class UserService : IUserService
{
public List GetFunctionsByUserId(Guid id)
{
var user = TestUsers.Users.SingleOrDefault(r => r.Id.Equals(id));
return user?.Urls;
}
}
添加api类
[Authorize(Policy = "Permission")]
[Route("api/[controller]")]
[ApiController]
public class ValuesController : ControllerBase
{
[HttpGet("[action]")]
public ActionResult> GetAdminValue()
{
return new string[] { "use Policy = Permission" };
}
[HttpGet("[action]")]
public ActionResult> GetGuestValue()
{
return new string[] { "use Policy = Permission" };
}
[AllowAnonymous]
[HttpPost("[action]")]
public async Task> Login([FromBody]UserDto dto)
{
var user = TestUsers.Users.FirstOrDefault(s => s.UserName == dto.UserName && s.Password == dto.Password);
if (user != null)
{
//用户标识
var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
identity.AddClaim(new Claim(ClaimTypes.Sid, user.UserName));
identity.AddClaim(new Claim("id", user.Id.ToString()));
await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));
if (dto.ReturnUrl != null)
{
return Redirect(dto.ReturnUrl);
}
else
{
return RedirectToAction(nameof(ValuesController.GetAdminValue), "Values");
}
}
else
{
const string badUserNameOrPasswordMessage = "用户名或密码错误！";
return BadRequest(badUserNameOrPasswordMessage);
}
}
public class UserDto
{
public string UserName { get; set; }
public string Password { get; set; }
public string ReturnUrl { get; set; }
}
}
然后我们用Paul用户可以访问所有的接口，Young只能访问getguestvalue接口，Roy只能访问getadminvalue接口。