Web API中的自定义授权-ASP.Net Web API用户（System.Security.Claims.ClaimsPrincipal）中的IClaimsPrincipal

Question

I have a Web API for which I need to do custom authorization. I'm using oAuth tokens and I was thinking I might do additional checks by implementing an authorizationManager

using Microsoft.IdentityModel.Claims;
using System.Diagnostics;
using System.Linq;

public override bool CheckAccess(AuthorizationContext context){
    public override bool CheckAccess(AuthorizationContext context)
    {
        //authorization code here
    }
}

The problem arises when I attempt to create an AuthorizationContext I don't have the right principal type. I noticed that from my Web API call I get a user which is a System.Security.Claims.ClaimsPrincipal which is not castable to IClaimsPrincipal which is needed by new AuthorizationContext.

var authorizationContext = new AuthorizationContext(principal, "resource", "action");//System.Security.Claims.ClaimsPrincipal is the wrong type of principal here, but is what user is on Web API call.

This of course results in the following error:

cannot convert from 'System.Security.Claims.ClaimsPrincipal' to 'Microsoft.IdentityModel.Claims.IClaimsPrincipal'

Is there something other than ClaimsAuthorizationManager I should be implementing? Is there a simple way to create the context object I need given the type of principal I have?

I did notice that ClaimsAuthorizationManager is in Microsoft.IdentityModel.Claims while much of the other web api stuff is in Microsoft.AspNet.Identity or Microsoft.AspNet.Identity.Core which is perhaps a clue that it might not be the right thing to use.

Answer 1

I was in fact headed down the wrong path as indicated by the clues. I ended up implementing System.Web.Http.AuthorizeAttribute similar to this:

using System;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web;

public class AuthAttribute : System.Web.Http.AuthorizeAttribute
{
    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        //authorization stuff here
    }
}

and then in my WebApiConfig.cs in the Register method added:

config.Filters.Add(new AuthAttribute());