3

我之前问过类似的问题，在其他人的帮助下我取得了一些进展，但仍然不确定我做错了什么或错过了什么。

我的应用程序很简单：域用户通过身份验证。经过身份验证的用户（作者）创建一个请求，保存在数据库中。其他经过身份验证的用户只能查看该请求。作者和管理员用户可以编辑/删除请求。

这是我遵循的示例之一： 不同角色的不同 API 功能

而另一个 PoliciesAuthApp：https ://github.com/aspnet/Docs/tree/master/aspnetcore/security/authorization/policies/samples/PoliciesAuthApp1 我不确定 PermissionHandler 是如何在这里使用/注册/调用的。

这是我的代码：

启动.cs

//  Add Authentication
//  Global filter
services.AddMvc(config =>
{
    var policy = new AuthorizationPolicyBuilder()
                     .RequireAuthenticatedUser()
                     .RequireRole("Role - Domain Users")
                     .Build();
    config.Filters.Add(new AuthorizeFilter(policy));
});


//  Add Authorization Handlers
services.AddAuthorization(options =>
{
    options.AddPolicy("EditPolicy", policy => policy.Requirements.Add(new EditRequirement()));
});

services.AddSingleton<IAuthorizationHandler, PermissionHandler>();

编辑需求.cs

public class EditRequirement : IAuthorizationRequirement
{
}

权限处理程序.cs

public class PermissionHandler : IAuthorizationHandler
{

    public Task HandleAsync(AuthorizationHandlerContext context)
    {
        var pendingRequirements = context.PendingRequirements.ToList();

        foreach (var requirement in pendingRequirements)
        {
            if (requirement is ReadRequirement)
            {
                if (IsOwner(context.User, context.Resource) ||
                    IsAdmin(context.User, context.Resource))
                {
                    context.Succeed(requirement);
                }
            }
            else if (requirement is EditRequirement ||
                     requirement is DeleteRequirement)
            {
                if (IsOwner(context.User, context.Resource) || IsAdmin(context.User, context.Resource))
                {
                    context.Succeed(requirement);
                }
            }
        }
        return Task.CompletedTask;
    }

    private bool IsAdmin(ClaimsPrincipal user, object resource)
    {
        if (user.IsInRole("Role - Administrator"))
        {
            return true;
        }
        return false;
    }

    private bool IsOwner(ClaimsPrincipal user, object resource)
    {
        if (resource is CreateRequestViewModel)
        {
            var ctx = (CreateRequestViewModel)resource;

            if (ctx.RequestEnteredBy.Equals(user.Identity.Name))
            {
                return true;
            }
        }
        else if (resource is AuthorizationFilterContext)
        {
            var afc = (AuthorizationFilterContext)resource;

            //  This is not right, but I don't know how to deal with AuthorizationFilterContext 
            //  type passed into resource parameter when I click Edit button trying to edit the request
            if (afc.HttpContext.User.Identity.Name.Equals(user.Identity.Name))
            {
                return true;
            }
        }
        else if (resource is Request)
        {
            var r = (Request)resource;

            if (r.RequestEnteredBy.Equals(user.Identity.Name))
            {
                return true;
            }
        }


        return false;
    }

    private bool IsSponsor(ClaimsPrincipal user, object resource)
    {
        // Code omitted for brevity

        return true;
    }
}

请求控制器.cs

private IAuthorizationService _authorizationService;

public RequestsController(ApplicationModelContext context, IAuthorizationService authorizationService)
{
    _context = context; 
    _authorizationService = authorizationService;
}

[Authorize(Policy = "EditPolicy")]
public async Task<IActionResult> Edit(int? id)
{
    if (id == null)
    {
        return NotFound();
    }

    CreateRequestViewModel crvm = new CreateRequestViewModel();

    var request = await _context.Request
                .SingleOrDefaultAsync(m => m.RequestId == id);

    if (request == null)
    {
        return NotFound();
    }

    var authorizationResult = await _authorizationService.AuthorizeAsync(User, request, "EditPolicy");

    if (authorizationResult.Succeeded)
    {   
        //  Load request contents and return to the view

        return View(crvm);
    }

    //  This needs to be changed to redirect to a message screen saying no permission
    return RedirectToAction("Details", new { id = request.RequestId });
}

在调试应用程序时，我发现：

  • 当页面第一次从数据库加载请求时，它会将一个 CreateRequestViewModel 类型的对象传递给 PermissionHandler 中 IsOwner 方法的资源参数。
  • 单击页面上请求项的编辑按钮后，它通过 AuthorizationFilterContext 类型
  • 然后进入 ReuqestController 中的 Edit 操作，该操作发送请求类型（在 _authorizationService.AuthorizeAsync 中）。

不确定我是否做了重复的事情或完全混合了不同的方法。

任何建议将不胜感激。

4

1 回答 1

6

看起来您正在混合基于策略和资源的授权。基于资源的听起来像你想要的，因为你可能不想为每个 CRUD 操作创建策略，即“CreateUserPolicy”、“UpdateUserPolicy”，然后将不同的要求传递给每个操作。有关基于资源的授权，请参阅本教程：https ://docs.microsoft.com/en-us/aspnet/core/security/authorization/resourcebased?view=aspnetcore-2.2

为了对用户资源进行授权，我创建了一个 UserAuthorizationHandler：

启动.cs：

services.AddScoped<IAuthorizationHandler, UserAuthorizationHandler>();

用户授权处理程序.cs

public class UserAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, User>
{
    private readonly IPermissionRepository _permissionRepository;

    public UserAuthorizationHandler(IPermissionRepository permissionRepository)
    {
        _permissionRepository = permissionRepository;
    }

    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, OperationAuthorizationRequirement requirement, User resource)
    {
        var authUserId = int.Parse(context.User.FindFirstValue(ClaimTypes.NameIdentifier));

        if (requirement == AuthorizationOperations.Create)
        {
            if (await CanCreate(authUserId))
            {
                context.Succeed(requirement);
            }
        }
        else if (requirement == AuthorizationOperations.Read)
        {
            if (await CanRead(authUserId, resource))
            {
                context.Succeed(requirement);
            }
        }
    }

    /// <summary>
    /// User can create if they have 'create' 'users' permission.
    /// </summary>
    /// <param name="authUserId">The requesting user</param>
    /// <returns></returns>
    public async Task<bool> CanCreate(int authUserId)
    {
        return await _permissionRepository.UserHasPermission(authUserId, "create", "users");
    }

    /// <summary>
    /// User can read if reading themselves or they have the 'read' 'users' permission.
    /// </summary>
    /// <param name="authUserId">The requesting user</param>
    /// <param name="user">The requested resource</param>
    /// <returns></returns>
    public async Task<bool> CanRead(int authUserId, User user)
    {
        return authUserId == user.Id || await _permissionRepository.UserHasPermission(authUserId, "read", "users");
    }
}

控制器：

  var authorized = await _authorizationService.AuthorizeAsync(User, new User { Id = id}, AuthorizationOperations.Read);
  if (!authorized.Succeeded)
  {
    return Unauthorized();
  }
于 2019-09-11T23:18:00.047 回答