如何在ASP.NET Core中修复基于策略的授权

Question

I'm trying to implement a policy based authorization on my Movies controller to only allow access for an Admin user.

I added an authorization policy "CanManageMovies" and assigned it to the Admin role. Then, I added the policy to my Movies controller. I seeded the Admin role and user in my Db.

// Authorization policy in Startup.cs ConfigureServices method

services.AddAuthorization(options =>
            {
                options.AddPolicy("CanManageMovies",
                    policy => policy.RequireRole("Admin"));
            });

// Movies controller

[Authorize(Policy = "CanManageMovies")]
    public class MoviesController : Controller
    {
      // code removed for brevity
    }

// This seeds the admin user and role. 
// The SeedData method is called in the Startup configure method. 

public class MyIdentityDbInitializer
    {
        public static void SeedData(UserManager<IdentityUser> userManager,
            RoleManager<IdentityRole> roleManager)
        {
            SeedRoles(roleManager);
            SeedUsers(userManager);
        }

        public static void SeedUsers(UserManager<IdentityUser> userManager)
        {
            if (userManager.FindByNameAsync
                ("user@vidly.com").Result == null)
            {
                IdentityUser user = new IdentityUser();
                user.UserName = "user@vidly.com";
                user.Email = "user1@localhost";

                IdentityResult result = userManager.CreateAsync
                (user, "Password#1").Result;

                if (result.Succeeded)
                {
                    userManager.AddToRoleAsync(user,
                                        "User").Wait();
                }
            }

            if (userManager.FindByNameAsync
            ("admin@vidly.com").Result == null)
            {
                IdentityUser user = new IdentityUser();
                user.UserName = "admin@vidly.com";
                user.Email = "admin@vidly.com";

                IdentityResult result = userManager.CreateAsync
                (user, "Password#1").Result;

                if (result.Succeeded)
                {
                    userManager.AddToRoleAsync(user,
                                        "Admin").Wait();
                }
            }
        }

        public static void SeedRoles(RoleManager<IdentityRole> roleManager)
        {
            if (!roleManager.RoleExistsAsync("User").Result)
            {
                IdentityRole role = new IdentityRole();
                role.Name = "User";
                IdentityResult roleResult = roleManager.
                CreateAsync(role).Result;
            }


            if (!roleManager.RoleExistsAsync
            ("Admin").Result)
            {
                IdentityRole role = new IdentityRole();
                role.Name = "Admin";
                IdentityResult roleResult = roleManager.
                CreateAsync(role).Result;
            }
        }
    }

When I run the app, navigate to Movies, and login with the Admin user, I expect to access the view, but I receive a "Not Authorized" message.

Answer 1

Check if the ConfigureServices method and the Configure method in Startup.cs like below:

 public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(
                Configuration.GetConnectionString("DefaultConnection")));
        services.AddDefaultIdentity<IdentityUser>()
            .AddRoles<IdentityRole>()
            .AddDefaultUI(UIFramework.Bootstrap4)
            .AddEntityFrameworkStores<ApplicationDbContext>();

        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        services.AddAuthorization(options =>
        {
            options.AddPolicy("CanManageMovies",
                policy => policy.RequireRole("Admin"));
        });
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env, IServiceProvider serviceProvider, UserManager<IdentityUser> userManager, RoleManager<IdentityRole> roleManager)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();

        app.UseAuthentication();
        MyIdentityDbInitializer.SeedData(userManager, roleManager);

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }

Here is a simple working demo , you could refer to and check the difference .