dotnet core 3.0 WebApi、applicationPart和授权

Question

We have a modular application, which means that our api controllers get loaded during startup. We load the controllers into the applicationPart like this:

services.AddMvc()
            .SetCompatibilityVersion(CompatibilityVersion.Version_3_0)
            .ConfigureApplicationPartManager(applicationPartManager =>
            {
                foreach (var module in _modules)
                {
                    var apiControllerAssemblies = module.GetApiControllerAssemblies();

                    foreach (var apiControllerAssembly in apiControllerAssemblies)
                        applicationPartManager.ApplicationParts.Add(new AssemblyPart(apiControllerAssembly));
                }
            });

We want to protect our apis with Basic authentication. I've created a middleware like this:

 public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
    {
        public BasicAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, 
                                          ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) : base(options, logger, encoder, clock)
        {
        }

        protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
        {
            if (!Request.Headers.ContainsKey("Authorization"))
                return AuthenticateResult.Fail("Missing Authorization 
                                                Header");
            //More to come
        }
    }

The middleware is registered in startup.cs like this:

services.AddAuthentication("Basic")
             .AddScheme<AuthenticationSchemeOptions, BasicAuthenticationHandler>("Basic", null);

Accessing localhost: will always trigger the HandleAuthenticateAsync method. However when I try to access the localhost:/user/users endpoint the method never hit the breakpoint and will always result in a HTTP 401 Unauthorized. The controller itself is marked with the Authorize attribute.

Any ideas where it goes wrong? Any hints to where I should start looking for a solution?

Thanks!

Answer 1

Not sure if this helps, but when I had to implement Authentication this is what I did.

a. Declare a class extending AuthenticationSchemeOptions

    public class CustomAuthOptions: AuthenticationSchemeOptions
    {
    }

b. Declare a class implementing the AuthenticationHandler<TOptions>

    internal class CustomAuthHandler : AuthenticationHandler<CustomAuthOptions>
    {
        IHttpContextAccessor _httpContextAccessor;
        IUser _user;

        public CustomAuthHandler(IOptionsMonitor<CustomAuthOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock, 
            IHttpContextAccessor httpContextAccessor, IUser user) : base(options, logger, encoder, clock)
        {
            _httpContextAccessor = httpContextAccessor;
            _user = user;
        }

        protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
        {
            //logic to authenticate
        }

        protected override Task HandleChallengeAsync(AuthenticationProperties properties)
        {
            //more code
        }
   }

c. Add an extension method to the AuthenticationBuilder class

        public static AuthenticationBuilder AddCustomAuth(this AuthenticationBuilder builder,
            Action<CustomAuthOptions> config)
        {
            return builder.AddScheme<CustomAuthOptions, CustomAuthHandler>("CheckInDB", "CheckInDB", config);
        }

d. Finally in the Startup.cs

            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = "CheckInDB";
                options.DefaultChallengeScheme = "CheckInDB";
            }).AddCustomAuth(c => { });

This may be more than what is needed, but when I was in the same boat, a couple of months ago, I spent a good few days piecing all of this together.