如何在ASP.NET Core中创建自定义策略AuthorizeAttribute？

Question

I'm working on an intranet app(login by AD), which need authorize rights by users' department,title,or others information in AD.

In MS Docs, it seems that i should use Claims-based authorization( https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims?view=aspnetcore-2.2 ).

As you can image, some page should be authorized by different department, as the link said, what i can do is add several department Policies, but it's boring, because i have dozens of departments.

What can i do to implement like this or something else:

[Authorize(Policy = "Department" , Value = "Finance")]
[Authorize(Policy = "Title" , Value = "VP")]

Thanks in advance.

Answer 1

You're looking for policy-based authorization .

A policy consists of one or more requirements which you can define by implementing the IAuthorizationRequirement interface. Then you create an AuthorizationHandler<T> where you validate the current context against the given requirement. In your case that is validating whether the current user is part of the required department specified in the [Authorization] attribute. If you want more control or have more specific authorization logic, you can implement a IAuthorizationHandler to handle multiple requirements at once.

I suggest you take a look at the documentation for implementing and registering policies with their requirements and handlers.

Answer 2

In addition to what Henk said, you can use an external policy-based framework such as xacml or alfa . The end result is similar to what Henk wrote but it's policy-based rather than code-based (using IAuthorizationRequirement ).

A policy looks like plain old English.

policyset documents{
    target clause objectType == "document"
    apply firstApplicable
    policy employees{
        target clause user.role == "employee"
        apply firstApplicable
        /**
         * Employees can create documents in their own company
         */
         rule createDocument{
             target clause action.actionId=="create"
             condition user.company==resource.company
             permit
         }
         /**
          * Employees can delete documents they own
          */
        rule allowDelete{
            target clause action.actionId == "delete"
            condition user.userId == resource.owner
            permit
        }
    }
}

You then need to deploy the policy to your authorization engine / policy decision point and you invoke it from an interceptor within your app. Doing it this way keeps business logic (the app) separate from authorization logic (the policies). It also means that you can reuse the same policies / authorization across your apps no matter the language and across your stack (API, app, DB...)