如何在 ASP.NET CORE 中为多个策略创建自定义授权属性

Question

我想授权一个动作控制器可以通过多个策略访问。

。例如：

[Authorize([Policies.ManageAllCalculationPolicy,Policies.ManageAllPriceListPolicy]]
public async Task<IActionResult> Get(int id){}

非常感谢。

Answer 1

对于多个策略，您可以实现自己的 AuthorizeAttribute。

• AuthorizeMultiplePolicyAttribute

   public class AuthorizeMultiplePolicyAttribute:TypeFilterAttribute
   {
   public AuthorizeMultiplePolicyAttribute(string policies,bool IsAll):base(typeof(AuthorizeMultiplePolicyFilter))
   {
       Arguments = new object[] { policies,IsAll};
   }
   }
  

• 授权多重策略过滤器

   public class AuthorizeMultiplePolicyFilter: IAsyncAuthorizationFilter
   {
   private readonly IAuthorizationService _authorization;
   public string _policies { get; private set; }
   public bool _isAll { get; set; }
   public AuthorizeMultiplePolicyFilter(string policies, bool IsAll,IAuthorizationService authorization)
   {
       _policies = policies;
       _authorization = authorization;
       _isAll = IsAll;
   }
  
   public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
   {
  
       var policys = _policies.Split(";").ToList();
       if (_isAll)
       {
           foreach (var policy in policys)
           {
               var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
               if (!authorized.Succeeded)
               {
                   context.Result = new ForbidResult();
                   return;
               }
           }
       }
       else
       {
           foreach (var policy in policys)
           {
               var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
               if (authorized.Succeeded)
               {
                   return;
               }
           }
           context.Result = new ForbidResult();
           return;
       }
   }
   }
  

• 在启动时添加您想要的策略

   services.AddAuthorization(options =>
       {
  
           options.AddPolicy("ManageAllCalculationPolicy", policy =>
                   policy.RequireAssertion(context =>
                       context.User.HasClaim(c => c.Type == "BadgeId")));
  
           options.AddPolicy("ManageAllPriceListPolicy", policy =>
                   policy.RequireAssertion(context =>
                       context.User.HasClaim(c => c.Type == "aaaa")));
       });
  

• 基于其中一项政策的授权

   [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", false)]
  

• 基于所有策略的授权

   [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", true)]
  

Answer 2

不可以，您不能将多个策略添加为具有条件的列表or。我认为 NetCore 不支持这一点。

尝试制定新政策。

services.AddAuthorization(options =>
{
    options.AddPolicy("BadgeEntry", policy =>
        policy.RequireAssertion(context =>
            context.User.HasClaim(c =>
                (c.Type == ClaimTypes.BadgeId ||
                 c.Type == ClaimTypes.TemporaryBadgeId) &&
                 c.Issuer == "https://microsoftsecurity")));
});

参考： https: //learn.microsoft.com/en-us/aspnet/core/security/authorization/policies ?view=aspnetcore-2.1#why-would-i-want-multiple-handlers-for-a-requirement