在 .NET 中使用自定义授权属性实现基于声明的动态身份验证 6

Question

I am creating a .NET 6 application that connects to an external identity provider for authentication using cookie authentication and OpenIdConnect. The external provider returns the user's JWT. Within that JWT, there are claims which denote which resources the user should have access to. These claims have a custom claim type of "privilege" and a unique value (something like "privilege": "create_blog").

I see that you can add a policy to check for a specific claim, like:

builder.Services.AddAuthorization(options =>
{
   options.AddPolicy("CreateBlog", policy => policy.RequireClaim("privilege", "create_blog"));
});

However, in our application, I want to be able to specify the claim value via the attribute (because our system has hundreds of different privileges) like:

[PrivilegeAuthorize("create_blog")]
public IActionResult CreateBlog { ... }

I tried creating a custom authorization provider & authorization handler as described in the docs . That gets triggered & executed fine. However, when the provider fails (because the user is unauthenticated or the claim is missing), it doesn't trigger the right response. The user is redirected to /Account/Login (the default LoginPath for the CookieAuthenticationOptions). But I want it to OIDC identity provider if the user is not authenticated, and show my "Access Denied" page if the claim is missing.

Answer 1

I was finally able to develop a solution for this problem that conforms with Microsoft's suggested approaches for creating authentication policies and custom authorization providers. I created a custom authorization policy provider which uses Microsoft's provided AuthorizationOptions.AddPolicy(string, Action<AuthorizationPolicyBuilder>) method instead of instantiating a new AuthorizationPolicyBuilder for building the policy. I implemented that policy provider using a custom authorization attribute.

The content of the custom authorization provider is as follows:

public class PrivilegeAuthorizationProvider : IAuthorizationPolicyProvider
{
    private readonly AuthorizationOptions _options;
    private Task<AuthorizationPolicy>? _cachedDefaultPolicy;
    private Task<AuthorizationPolicy?>? _cachedFallbackPolicy;

    public PrivilegeAuthorizationProvider (IOptions<AuthorizationOptions> options)
    {
        this._options = options.Value;
    }

    public Task<AuthorizationPolicy> GetDefaultPolicyAsync()
    {
        if (this._cachedDefaultPolicy == null || this._cachedDefaultPolicy.Result != this._options.DefaultPolicy)
        {
            this._cachedDefaultPolicy = Task.FromResult(this._options.DefaultPolicy);
        }

        return this._cachedDefaultPolicy;
    }

    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync()
    {
        if (this._cachedFallbackPolicy == null || this._cachedFallbackPolicy.Result != this._options.FallbackPolicy)
        {
            this._cachedFallbackPolicy = Task.FromResult(this._options.FallbackPolicy);
        }

        return this._cachedFallbackPolicy;
    }

    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
    {
        AuthorizationPolicy _policy = this._options.GetPolicy(policyName);
        if (_policy != null)
        {
            return Task.FromResult(_policy);
        }

        if (_policy == null && policyName.StartsWith(PrivilegeAuthorizeAttribute.PolicyPrefix, StringComparison.OrdinalIgnoreCase))
        {
            string[] _splitPolicyName = policyName.Split(PrivilegeAuthorizeAttribute.PolicyNameSeparator);

            if (_splitPolicyName.Length == 2)
            {
                string[] _values = _splitPolicyName[1].HasValue()
                    ? _splitPolicyName[1].Split(PrivilegeAuthorizeAttribute.ClaimValuesSeparator)
                    : Array.Empty<string>();

                if (_values.Length > 0)
                {
                    this._options.AddPolicy(policyName, policy => policy.RequireClaim("privilege", _values));
                    _policy = this._options.GetPolicy(policyName);
                }
            }
        }

        return Task.FromResult(_policy);
    }
}

In the application's program.cs (or startup.cs), the custom authorization provider is registered like:

_builder.Services.AddSingleton<IAuthorizationPolicyProvider, PrivilegeAuthorizationProvider>();

_builder.Services.AddAuthorization();
_builder.Services.AddAuthentication(opt =>
    {
        opt.DefaultScheme = "Cookies";
        opt.DefaultChallengeScheme = "oidc";
    })
    .AddCookie("Cookies")
    .AddOpenIdConnect("oidc", opt => { ... });

The custom authorization attribute is as follows:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class PrivilegeAuthorizeAttribute : AuthorizeAttribute
{
    internal const char ClaimValuesSeparator = ",";
    internal const char PolicyNameSeparator = ":";
    internal const string PolicyPrefix = "PrivilegeAuthorize";

    public PrivilegeAuthorizeAttribute(string value)
    {
        this.Values = new[] { value };
    }

    public PrivilegeAuthorizeAttribute(params string[] values)
    {
        this.Values = values;
    }

    protected string?[] Values
    {
        get
        {
            if (this.Policy.HasValue())
            {
                string[] _splitPolicy = this.Policy!.Split(PolicyNameSeparator);
                if (_splitPolicy.Length == 2 && _splitPolicy[1].HasValue()
                {
                    return _splitPolicy[1].Split(ClaimValuesSeparator);
                }
            }

            return Array.Empty<string>();
        }
        set
        {
            this.Policy = $"{PolicyPrefix}{PolicyNameSeparator}{string.Join(ClaimValuesSeparator, value)}";
        }
    }
}

Then the attribute can be applied to a controller, an action method, or a razor page like:

[PrivilegeAuthorize("MySpecialPrivilegeClaimValue")]
public class Index : PageModel
{
   public void OnGet()
   { }
}

With this, the application checks the user's token for a claim of type "privilege" and a value which is specified in the attribute parameter. If the user isn't authenticated, they're redirected to the OIDC provider. If the user is authenticated, but the claim doesn't exist, the user is redirected to the application's internal "Access Denied" page. If the user is authenticated and has the proper claim, they can see the desired page.