ASP.NET Core 2 - AD 组未映射到安全角色

Question

I have been retrieving the username via User.Identity.Name, however I need a way to limit access to certain pages via groups in Active Directory.

For example 'Domain Admins' can see all the pages and 'View Users' can only see the landing page and one other.

In Startup.cs

services.AddAuthentication(IISDefaults.AuthenticationScheme);

            services.AddAuthorization(options =>
            {
                options.AddPolicy("AdminRoleOnly", policy => policy.RequireRole(Configuration["SecuritySettings:AdminGroup"]));
            });

            services.AddMvc(config =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();

                config.Filters.Add(new AuthorizeFilter(policy));
            });

Config:

  "SecuritySettings": {
    "AdminGroup": "MYDOMAIN\\Domain Admins"
  }

On my page model (I do not have controllers):

[Authorize(Policy = "AdminRoleOnly")]
    public class RequestsModel : PageModel

I just get an error saying I am not authorised no matter what

Answer 1

In the end I wrote a handler myself (with some help of another post):

 public class CheckADGroupHandler : AuthorizationHandler<CheckADGroupRequirement>
    {
        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                       CheckADGroupRequirement requirement)
        {

        var groups = new List<string>();
        var wi = (WindowsIdentity)context.User.Identity;
        if (wi.Groups != null)
        {
            foreach (var group in wi.Groups)
            {
                try
                {
                    groups.Add(group.Translate(typeof(NTAccount)).ToString());
                }
                catch (Exception e)
                {
                    Console.WriteLine(e.ToString());
                }
            }

            foreach (string policygroup in requirement.GroupName)
            {

                if (groups.Contains(policygroup))
                {
                    context.Succeed(requirement);
                }
            }
        }

        return Task.CompletedTask;
    }
}