如何使用身份 2.0 使用授权属性在操作中添加多个策略？

Question

我是身份 2.1.2 和 asp.net core 2.0，我有应用程序声明表，其中包含声明类型和声明值，即资产、资产编辑、资产、资产视图，其中声明类型与不同的声明值相同，我正在创建策略使用对我来说工作正常的声明类型名称不知道如何在一个操作中添加多个策略。下面的代码在启动文件中用于创建策略。

services.AddAuthorization(options =>
{
   var dbContext = SqlServerDbContextOptionsExtensions.UseSqlServer(new DbContextOptionsBuilder<MyDBContext>(),
      Configuration.GetConnectionString("TestIdentityClaimAuth")).Options;

   var dbCon = new MyDBContext(dbContext);
   //Getting the list of application claims.
   var applicationClaims = dbCon.ApplicationClaims.ToList();
   var strClaimValues = string.Empty;
   List<ClaimVM> lstClaimTypeVM = new List<ClaimVM>();
   IEnumerable<string> lstClaimValueVM = null;// new IEnumerable<string>();

   lstClaimTypeVM = (from dbAppClaim
         in dbCon.ApplicationClaims
      select new ClaimVM
      {
         ClaimType = dbAppClaim.ClaimType
      }).Distinct().ToList();

   foreach (ClaimVM objClaimType in lstClaimTypeVM)
   {
      lstClaimValueVM = (from dbClaimValues in dbCon.ApplicationClaims
         where dbClaimValues.ClaimType == objClaimType.ClaimType
         select dbClaimValues.ClaimValue).ToList();

      options.AddPolicy(objClaimType.ClaimType, policy => policy.RequireClaim(objClaimType.ClaimType, lstClaimValueVM));
      lstClaimValueVM = null;
   }
});

在我的控制器中使用像这样的 Autherize 属性。

[Authorize(Policy = "Assets Edit")]

请提前给它遮光，谢谢。

Answer 1

对于多个策略，您可以实现自己的AuthorizeAttribute.

• MultiplePolicysAuthorizeAttribute

  public class MultiplePolicysAuthorizeAttribute : TypeFilterAttribute
  {
       public MultiplePolicysAuthorizeAttribute(string policys, bool isAnd = false) : base(typeof(MultiplePolicysAuthorizeFilter))
       {
           Arguments = new object[] { policys, isAnd };
       }
  }
  

• MultiplePolicysAuthorizeFilter

  public class MultiplePolicysAuthorizeFilter : IAsyncAuthorizationFilter
  {
      private readonly IAuthorizationService _authorization;
      public string Policys { get; private set; }
      public bool IsAnd { get; private set; }
  
      public MultiplePolicysAuthorizeFilter(string policys, bool isAnd, IAuthorizationService authorization)
      {
         Policys = policys;
         IsAnd = isAnd;
         _authorization = authorization;
      }
  
      public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
      {
          var policys = Policys.Split(";").ToList();
          if (IsAnd)
          {
              foreach (var policy in policys)
              {
                  var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
                  if (!authorized.Succeeded)
                  {
                      context.Result = new ForbidResult();
                      return;
                  }
  
              }
           }
           else
           {
              foreach (var policy in policys)
              {
                   var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
                   if (authorized.Succeeded)
                   {
                       return;
                   }
  
              }
              context.Result = new ForbidResult();
              return;
          }
       }
  }
  

• 只需要一项政策

  [MultiplePolicysAuthorize("Assets View;Assets Edit;Assets Delete")]
  

• 只需要所有的政策

  [MultiplePolicysAuthorize("Assets View;Assets Edit;Assets Delete", true)]
  

Answer 2

如果您只是想应用多个策略，您可以这样做：

[Authorize(Policy = "Asset")]
[Authorize(Policy = "Edit")]
public class MyController : Controller {

}

编辑：澄清一下，这是附加的 - 您必须通过这两个政策要求。