身份验证角色不起作用 .net 核心 mvc

Question

everybody, I have used Authentication in my application with identity in .net core MVC everything works fine and even when I check User.IsInRole("Admin") works perfect what I try to use is checking Authorize in the controller but it doesn't work the page open even the user didn't have permission for that I try to use police from jwt but no sense

this is my startup

 public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {

        services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer(Configuration.GetConnectionString("DotnetCore")));

        // inject user Identity to use it in case without email vervication 

        services.AddIdentity<ApplicationUser, IdentityRole>()
            .AddEntityFrameworkStores<ApplicationDbContext>()
            .AddDefaultTokenProviders();



        services.AddAuthentication("CookieAuthentication")
             .AddCookie("CookieAuthentication", config =>
             {
                 config.Cookie.Name = "UserLoginCookie"; // Name of cookie   
                 config.LoginPath = "/Home/Index"; // Path for the redirect to user login page  
                 config.AccessDeniedPath = "/Home/AccessDenied";
             });

        services.AddAuthorization(config =>
        {
            config.AddPolicy("IsAdmin", policyBuilder =>
            {
                policyBuilder.UserRequireCustomClaim(ClaimTypes.Role);
            });
        });







        //  services.AddOptions();

        //In-Memory
        services.AddDistributedMemoryCache();
        services.AddSession(options => {
            options.IdleTimeout = TimeSpan.FromDays(1);
        });


        services.Configure<EmailSettings>(Configuration.GetSection("EmailSettings"));



        // add lang

        services.AddLocalization(options => options.ResourcesPath = "Resources");

        // add lang

        services.AddMvc()
            .AddViewLocalization(option => { option.ResourcesPath = "Resources"; })
            .AddViewLocalization(LanguageViewLocationExpanderFormat.Suffix)
            .AddDataAnnotationsLocalization();


        services.Configure<RequestLocalizationOptions>(opts =>
        {
            var supportedCultures = new List<CultureInfo>
            {
                new CultureInfo("en"),
                new CultureInfo("fr"),
            };

            opts.DefaultRequestCulture = new RequestCulture("en");
            opts.SupportedCultures = supportedCultures;
            opts.SupportedUICultures = supportedCultures;
        });


        //Password Strength Setting
        services.Configure<IdentityOptions>(options =>
        {
            // Password settings
            options.Password.RequireDigit = true;
            options.Password.RequireNonAlphanumeric = false;
            options.Password.RequireUppercase = false;
            options.Password.RequireLowercase = false;

            // Lockout settings
            options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
            options.Lockout.MaxFailedAccessAttempts = 5;
            options.Lockout.AllowedForNewUsers = true;

            // User settings
            options.User.RequireUniqueEmail = true;
        });



        //JWT Token for User Authentication 

        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidIssuer = Configuration["Jwt:Issuer"],
                    ValidAudience = Configuration["Jwt:Audience"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
                };
            });




        // Add application services.

        services.AddTransient<IEmailSender, EmailSender>();



        services.AddScoped<IAuthorizationHandler, PoliciesAuthorizationHandler>();
        services.AddScoped<IAuthorizationHandler, RolesAuthorizationHandler>();

        services.AddControllersWithViews();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            app.UseHsts();
        }

        var options = app.ApplicationServices.GetService<IOptions<RequestLocalizationOptions>>();
        app.UseRequestLocalization(options.Value);

        app.UseSession();
        app.UseHttpsRedirection();
        app.UseStaticFiles();

        app.UseRouting();

        // who are you?
        app.UseAuthentication();

        // are you allowed?
        app.UseAuthorization();


        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }

my login code is

   var result = await _signInManager.PasswordSignInAsync(model.Username, model.Password, model.RememberMe, lockoutOnFailure: true);


                if (result.Succeeded)
                {
                    _logger.LogInformation("User logged in.");


                    //added new part of jwt

                    //Save token in session object
                    var tokenvalue = GenerateJSONWebToken(model);
                    HttpContext.Session.SetString(tokenvalue, "tokencode");

                    // End of Jwt


                    return RedirectToAction("Index", "DashBoard");
                }
                if (result.IsLockedOut)
                {
                    _logger.LogWarning("User account locked out.");
                    return RedirectToAction(nameof(Lockout));
                }
                else
                {
                    ModelState.AddModelError(string.Empty, "Invalid login attempt.");
                    return View(model);
                }
            }

            ModelState.AddModelError(string.Empty, "Invalid login attempt.");
            return View(model);

in chtml pages and it works perfect

@if (SignInManager.IsSignedIn(User)) {

if (User.IsInRole("Admin"))
    {
        // do something
    }

}

I try to check Authorize using police or roles but no way

[Authorize(Policy = "IsAdmin")]
        [Authorize(UserRoles.AdminEndUser)]
        public IActionResult Index()
        {
            return View();
        }

but it doesn't work I use .net core 3.1 and also I have added 3 classes helper for AuthorizationPolicyBuilder to check policy required and roles type

Answer 1

You don't need to create your policy to check Role claim.

You can use the Authorize attribute like this:

[Authorize(Roles = "Admin")]

Answer 2

You can also use it to multiple role like this

[Authorize(Roles = "Admin,CustomerServices,etc")]