ASP.NET Core 策略库使用 RequireUser 和字符串数组进行授权

Question

我正在创建策略库授权，并希望允许一个策略中的多个用户访问网页。

我在启动文件中创建了如下所示的策略。问题，如何在一个策略中使用多个用户名？我查看了 的方法.RequireUserName，它只接受字符串用户名。

策略名称AdminServiceAccount主要是我对添加多个用户感兴趣。如果我使用 param.RequireUserName("DOMAIN\\USER1,DOMAIN\\USER2")会起作用吗？我不这么认为，但想检查是否有替代方法。

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("Admin", policy => policy.RequireRole("Domain\\GroupName"));
                    option.AddPolicy("SuperAdminUser", policy => policy.RequireUserName("DOMAIN\\SuperAdminUser"));
                    option.AddPolicy("AdminServiceAccount", policy => policy.RequireUserName("DOMAIN\\USER1"));
                }
        );

更新1：

更新 2：

所以在我的控制器中，我添加[Authorize(Policy = "UserNamesPolicy")]如下所示：

[Authorize(Policy = "UserNamesPolicy")]
public class ServersController : Controller
{
    private readonly ServerMatrixDbContext _context;

    public ServersController(ServerMatrixDbContext context)
    {
        _context = context;    
    }

    // GET: Servers
    public async Task<IActionResult> Index()
    {
        // Some code here
        return View();
    }
}

这是我的启动文件：

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("UserNamesPolicy",
                                          policy => policy.Requirements.Add(new UserNamesRequirement("DOMAIN\\USER1", "DOMAIN\\USER2"))
                    );
                }
        );
services.AddSingleton<IAuthorizationHandler, UserNamesRequirement();

对于.AddSingleTon在启动文件中，我收到以下错误：

这是handler课程：

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

这是 UserNamesRequirement 类：

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] UserNames)
    {
        Users = UserNames;
    }
    public string[] Users { get; set; }
}

更新 3：已解决！！！！

以下是从更新 2添加的一些更改：

在UserNameshandler课堂上更改了 var userName 以从中获取值context.User.Identity.Name;

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        // var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;
        var userName = context.User.Identity.Name;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

在 StartUp 类中固定services.AddSingleton<IAuthorizationHandler, UserNamesRequirement>();为services.AddSingleton<IAuthorizationHandler,UserNamesHandler>();

感谢 Gevory。:)

Answer 1

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.Identity.Name;
        if(requirement.UserNames.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.CompletedTask; // if it does not compile use Task.FromResult(0);
    }
}

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] userNames)
    {
        UserNames = userNames;
    }

    public string[] UserNames { get; set; }
}

在 startup.cs 添加以下内容

public void ConfigureServices(IServiceCollection services)
{
            services.AddAuthorization(options =>
            {
                options.AddPolicy("UserNamesPolicy",
                                  policy => policy.Requirements.Add(new UserNamesRequirement("ggg","dsds")));
            });
           services.AddSingleton<IAuthorizationHandler, UserNamesHandler>()

}