自定义主体显示禁止授权过滤器属性 ASP.Net Core 6 MVC

Question

The application is an ASP.NET Core 6 MVC app and uses Windows authentication. Currently I have a ClaimsTransformation like this:

public class ClaimsTransformation : IClaimsTransformation
{
    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly IAuthenticationService _authenticationService;

    public ClaimsTransformation(IHttpContextAccessor accessor, IAuthenticationService authenticationService)
    {
        _httpContextAccessor = accessor;
        _authenticationService = authenticationService;
    }

    public async Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
    {
       if (principal != null && principal.Identity != null && !principal.Identity.IsAuthenticated)
            return principal;

        var clonedPrincipal = principal.Clone();
        var clonedClaims = clonedPrincipal.Claims.ToList();
        var clonedIdentity = clonedPrincipal.Identity;

        var customPrincipal = _authenticationService.WindowsAuthenticate(clonedIdentity);
        var customIdentity = (ClaimsIdentity)customPrincipal.Identity;

        foreach (var claim in clonedClaims)
        {
            customIdentity.AddClaim(claim);
        }

        _httpContextAccessor.HttpContext.User = customPrincipal;
        Thread.CurrentPrincipal = _httpContextAccessor.HttpContext.User;

        return await Task.FromResult(customPrincipal);
    }
}

However, when it reaches the controller which has a [Authorize] attribute, it displays a http 403 error. Kindly suggest. Thanks

Answer 1

1. Create the ClaimsTransformation in our application.

2. Register it in startup file.

    Startup.cs(.net Core <=5.0) :

    services.AddTransient<IClaimsTransformation, ClaimsTransformer>();

    Program.cs(.net Core >=6.0) :

    builder.Services.AddTransient<IClaimsTransformation, ClaimsTransformer>();

3. Set the policy.

   //.net core <= 5.0
   services.AddAuthorization(options =>
   {
       options.AddPolicy("Readonly", policy =>
                      policy.RequireClaim("permission", "readOnly"));

       options.AddPolicy("Write", policy =>
                    policy.RequireClaim("permission", "write"));
   });

   //.net core >= 6.0
   builder.Services.AddAuthorization(options =>
   {
       options.AddPolicy("Readonly", policy =>
                      policy.RequireClaim("permission", "readOnly"));

       options.AddPolicy("Write", policy =>
                    policy.RequireClaim("permission", "write"));
   });

4. Use it in the controller.

   [Authorize(Policy = "Write")]
   public IActionResult Contact()
   {
       ...
   }