授权属性用户/角色

Question

I am new with authorization and security to applications. I'm building upon my angularjs and web api app that uses Owin and AspNet.Identity.EntityFramework. I've been able to get the authorization working to force a user to either register / log in to the app. Now I'm looking on how to add more specific access such as a an admin role or specific user to look at more sensitive data. I've started with the [Authorize] attribute. Which forced the security. Then I added [Authorize(User="tbryant")] which didnt allow other users and even the user tbryant to log in. There is a user name in the AspNetUsers table of tbryant.

Here is my sample data from my api controller:

    [RoutePrefix("api/Orders")]
public class OrdersController : ApiController
{
    [Authorize(Users="tbryant")]
    [Route("")]        
    public IHttpActionResult Get()
    {
        return Ok(Order.CreateOrders());
    }
}


public class Order
{
    public int OrderID { get; set; }
    public string CustomerName { get; set; }
    public string ShipperCity { get; set; }
    public Boolean IsShipped { get; set; }

    public static List<Order> CreateOrders()
    {
        List<Order> OrderList = new List<Order> 
        {
            new Order {OrderID = 10248, CustomerName = "Tee Joudeh", ShipperCity = "Cleveland", IsShipped = true },
            new Order {OrderID = 10249, CustomerName = "Ahmad Hasan", ShipperCity = "Columbus", IsShipped = false},
            new Order {OrderID = 10250,CustomerName = "Thomas Yaser", ShipperCity = "Detroit", IsShipped = false },
            new Order {OrderID = 10251,CustomerName = "Lena Jones", ShipperCity = "Ann Arbor", IsShipped = false},
            new Order {OrderID = 10252,CustomerName = "Yasmeen Rami", ShipperCity = "Bamberg", IsShipped = true}
        };

        return OrderList;
    }
}

Answer 1

Make sure the "user.Identity.Name" in HttpContext is equal to "tbryant".

Here is how Authorize attribute works.

protected virtual bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
{
    throw new ArgumentNullException("httpContext");
}

IPrincipal user = httpContext.User;
if (!user.Identity.IsAuthenticated)
{
    return false;
}

if (_usersSplit.Length > 0 && !_usersSplit.Contains(user.Identity.Name, StringComparer.OrdinalIgnoreCase))
{
    return false;
}

if (_rolesSplit.Length > 0 && !_rolesSplit.Any(user.IsInRole))
{
    return false;
}

return true;
}