使用Windows身份验证的MVC 5自定义逻辑授权

Question

I have a MVC 5 project with Windows authentication.

I am using the default WindowsTokenRoleProvider as my role provider and it works for the following situation:

[CustomAuthorization(Roles = "DOMAIN\example_group")]
public ActionResult Action()...

It works great. The problem starts when I want to use custom role, for example: "Approver". In order to check who is a real approver, I have to query a special table and use custom logic to decide if the current person is an Approver.

In order to do this, I have overridden the AuthorizeCore of CustomAuthorize , and wrote something like this:

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    if(CheckIfCurrentUserIsAnApprover()){
        return true;
    }
    ...........
}

But what will happen when I will add another role, lets say Managers , I will have to add:

if(CheckIfCurrentUserIsManager()){
        return true;
}

How can I make it more generic?

Answer 1

This is a clear cut case for attribute based access control (ABAC).

ABAC extends role based access control with attributes so that you can make decisions based on things like a user's approval limit.

In ABAC, you get to write access control policies such as:

• a user with the role==approver can do the action==view on an object of type==transaction if the user.location==object.location.

The language used to write the policies is XACML (extensible access control markup language).

XACML also defines an architecture with the notion of:

• policy enforcement point: the interceptor in front of your app
• policy decision point: the engine that reaches decisions

You can read more here: http://developers.axiomatics.com/blog/index/entry/xacml-reference-architecture.html . Axiomatics provides a .net engine and a .net pep.