访问/保护Restful服务oAuth2

Question

I'm trying to write a Restful service which has more than one endpoints like

Assume each endpoint call is secured by a role.

1. GetEmployees (Role/Claim = Employee.Readonly or Employee.Edit or Employee.Admin)
2. AddEmployee (Role/Claim = Employee.Edit or Employee.Admin)
3. UpdateEmployee (Role/Claim = Employee.Edit or Employee.Admin)
4. DeleteEmployee (Role/Claim = Employee.Admin)

With Implicit flow, it is pretty straight forward just check roles claim and we are done.
My confusion is for client credential flow, how to map scopes to roles here?

Answer 1

Lets assume that you have the following situation for the Client Credentials approach:

var client = new TokenClient(
            BaseAddress + "/connect/token",
            "clientId",
            "clientSecret");

var result = client.RequestClientCredentialsAsync(scope: "my.api").Result;

var accessToken = result.AccessToken;

var client = new HttpClient();
client.SetBearerToken(accessToken);
var result = client.GetStringAsync("https://protectedapiaddress/api/data/getdata").Result;

Where BaseAddress is your IDS address.

Of course you will have to register your client in the IDS clients list with the appropriate flow (Client Credentials), and the scope is just optional, but I guess you will need one.

Then on the API side you can use the newly Policy-based authorization .

API method:

[HttpGet]
[Authorize(Policy = "AdminUser")]
[Route("getdata")]
public Data GetData()
{
  // some code here
}

And the Authorization Requirement:

public class AdminUserRequirement : AuthorizationHandler<AdminUserRequirement>, IAuthorizationRequirement
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, AdminUserRequirement requirement)
    {
        if (!context.User.HasClaim(<'Your rule'>))
        {
            context.Fail();
        }
        else
        {
            context.Succeed(requirement);
        }
        return Task.FromResult(0);
    }
}

In the claims you will have

    {
       "scope" : "my.api"
       "clientId" : "clientId"
    }

and more. And then you can apply the rules.

EDIT : Forgot to mention - you have to register the policies in your Startup.cs

public void ConfigureServices(IServiceCollection services)
{
    services
            .AddMvcCore()
            .AddAuthorization(options =>
            {
                    options.AddPolicy("AdminUser",
                    policy => policy.Requirements.Add(new AdminUserRequirement()));
            });

    // More code here

}