如何在.NET Core的基于策略的授权中添加应用逻辑

Question

I have the current setup working but I get an error like this:

An attempt was made to use the context instance while it is being configured. 
A DbContext instance cannot be used inside 'OnConfiguring' since it is still being configured at this point. 
This can happen if a second operation is started on this context instance before a previous operation completed. 
Any instance members are not guaranteed to be thread safe. 

I have created IAuthorizationRequirement

public class ValidGroupsRequirement : IAuthorizationRequirement
{
    private IAuthenticationService _authenticationService;
    public async Task<bool> ValidateAccess(IAuthenticationService authenticationService, List<string> groups)
    {
        _authenticationService = authenticationService;
        var result = await _authenticationService.AllGroupsExist(groups);
        return result;
    }
}

Also AuthorizationHandler

public class GroupsValidationHandler : AuthorizationHandler<ValidGroupsRequirement>
{
    private readonly IAuthenticationService authenticationService;
    
    public GroupsValidationHandler(IAuthenticationService authenticationService)
    {
        this.authenticationService = authenticationService;
    }
    
    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, ValidGroupsRequirement requirement)
    {
        var userGroups = context.User.FindAll("groups").Select(X => X.Value).ToList();
        var result = await requirement.ValidateAccess(authenticationService, userGroups);
        if (result)
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
            var filterContext = context.Resource as DefaultHttpContext;
            var response = filterContext.HttpContext.Response;
            response.OnStarting(async () =>
            {
                filterContext.HttpContext.Response.StatusCode = 401;
            });
        }
    }
}

And I have registered them in Program.cs

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ValidateGroups", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.AddRequirements(new ValidGroupsRequirement());
    });
    options.InvokeHandlersAfterFailure = false;
});

builder.Services.AddScoped<IAuthenticationService, AuthenticationService>();

I have the error in the authentication service.

Is it possible not to dispose it correctly since I am passing it to the requirement?

I know there is a way to create a handler without an requirement, but context.Succeed() method accepts requirement only. How should I then register it in program.cs

Thank you

Answer 1

I didn't have your problem after testing, everything works fine except that I cannot use _authenticationService.AllGroupsExist() , so I directly output the result as true to replace your output. IAuthenticationService does not seem to provide this method, did you customize it?

I registered Handler according to this document :

builder.Services.AddTransient<IAuthorizationHandler, GroupsValidationHandler>();

Then authorize certain operations:

[Authorize(Policy = "ValidateGroups")]

And everything is executing normally.

Can you provide a minimal example that reproduces the problem?

You can check this document and this post , it should help you.