asp.net-mvc – ASP.NET Core中基于活动的授权

Barry Dorrans(@blowdart)是绝对正确的,你不应该编写自己的自定义授权属性 – ASP.NET Core中的授权已经大大改进,你绝对可以根据自己的需要进行创建.

它当然在很大程度上取决于您当前的应用程序,以及您拥有的角色,因此我将基于您在上面提供的代码段做出一些假设.

在开始之前,我真的建议你阅读新的Authorization docs for ASP.NET Core,以及Barry Dorran在GitHub上的Authorization workshop.我强烈建议你通过后者,他也有一个.NET Core 2.0分支.

根据您的实现方式,您可以使用基于声明的授权,也可以使用基于资源的授权.

看看你的角色,看起来像基于资源的auth实际上可以在你的情况下工作得很好！

例如：

确定可能的操作(操作名称将从您的资源中获取)：

public static class Operations
{
    public static OperationAuthorizationRequirement Access = new OperationAuthorizationRequirement { Name = "Access" };
    public static OperationAuthorizationRequirement Copy = new OperationAuthorizationRequirement { Name = "Copy" };
    public static OperationAuthorizationRequirement Edit = new OperationAuthorizationRequirement { Name = "Edit" };
    public static OperationAuthorizationRequirement Save = new OperationAuthorizationRequirement { Name = "Save" };
    public static OperationAuthorizationRequirement Delete = new OperationAuthorizationRequirement { Name = "Delete" };
}

创建基本资源授权处理程序：

public abstract class BaseResourceAuthorizationHandler<TResource> : AuthorizationHandler<OperationAuthorizationRequirement,TResource>
{
    private readonly string _resourceType;
    public BaseResourceAuthorizationHandler(string resourceType)
    {
        _resourceType = resourceType;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,OperationAuthorizationRequirement requirement,TResource resource)
    {
        if (context.User.HasClaim("Resources",$"Can{requirement.Name}{_resourceType}"))
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

实现基于资源的特定处理程序.资源是应用程序中绑定对象到资源中的实体.此类将成为当前资源角色,Operations和ASP.NET Core中的授权系统之间的粘合剂.这些也可以扩展为为任何特定资源类型/操作添加额外的逻辑
例如,对于约会：

public class AppointmentAuthorizationHandler : BaseResourceAuthorizationHandler<Appointment>
{
    public AppointmentAuthorizationHandler() : base("Appointment") { }
}

然后你注册：

services.AddSingleton<IAuthorizationHandler,AppointmentAuthorizationHandler>();

然后在你的控制器中：

public class AppointmentsController : Controller
{
    IAppointmentsRepository _appointmentsRepository;
    IAuthorizationService _authorizationService;

    public AppointmentsController(IAppointmentsRepository appointmentsRepository,IAuthorizationService authorizationService)
    {
        _appointmentsRepository = appointmentsRepository;
        _authorizationService = authorizationService;
    }

    public IActionResult Edit(int id)
    {
        var appointment = _appointmentsRepository.Get(id);
        if (appointment == null)
        {
            return new NotFoundResult();
        }

        if (!(await _authorizationService.AuthorizeAsync(User,appointment,Operations.Edit)))
        {
            return new ChallengeResult();
        }

        return View(appointment);
    }
}

您也可以在视图中执行相同操作,以检查是否允许用户查看“编辑”按钮,例如：

@using Microsoft.AspNetCore.Authorization
@model IEnumerable<Appointment>
@inject IAuthorizationService AuthorizationService
<h1>Document Library</h1>
@foreach (var appointment in Model)
{
    if (await AuthorizationService.AuthorizeAsync(User,Operations.Edit))
    {
        <p>@Html.ActionLink("Appointment #" + appointment.Id,"Edit",new { id = appointment.Id })</p>
    }
}

附：只是添加一个注释 – 是的,你失去了按属性过滤的能力,但最终这种方式更好.首先 – 您远离基于字符串的角色,您根据操作类型和资源类型请求权限.其次,您可以以更好(和智能的方式)处理权限,以及组合多个权限检查.

它看起来更复杂,但它也更强大:)