[英]How to authorize user's role in client side of blazor wasm?
我想在服务器端和客户端之间使用基于角色的授权。
我可以正确登录并且UserManager.IsInRoleAsync(user, "admin")
在服务器端返回 True。
但是@attribute [Authorize(Roles = "admin")]
和<AuthorizeView Roles="admin">
在客户端都不起作用。 此外User.Identity.IsInRole("admin")
在客户端返回 False。
如何在客户端获得用户的角色?
// Startup.ConfigureServices()
services.AddDefaultIdentity<ApplicationUser>(options =>
{
options.SignIn.RequireConfirmedAccount = true;
options.Password.RequiredLength = 6;
options.Password.RequiredUniqueChars = 2;
options.Password.RequireNonAlphanumeric = false;
options.User.RequireUniqueEmail = true;
})
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>();
services.AddIdentityServer()
.AddApiAuthorization<ApplicationUser, ApplicationDbContext>();
services.AddAuthentication()
.AddIdentityServerJwt();
// Startup.Configure()
app.UseIdentityServer();
app.UseAuthentication();
app.UseAuthorization();
// RolesController.Get()
var userid = HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier);
var currentUser = await userManager.FindByIdAsync(userid);
return await userManager.IsInRoleAsync(currentUser, "admin"); // Returns True
// Program.Main()
builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("WebAppIdentity.ServerAPI"));
builder.Services.AddApiAuthorization();
// Test.razor
<AuthorizeView Roles="admin">
<Authorizing>
Authorizing...
</Authorizing>
<NotAuthorized>
You are not an admin. // Always here
</NotAuthorized>
<Authorized>
Hello, admin!
</Authorized>
</AuthorizeView>
<button @onclick="ShowInfo">Show Info</button>
<p>@infoString</p>
@code
{
[CascadingParameter]
private Task<AuthenticationState> stateTask { get; set; }
private string infoString { get; set; }
private async void ShowInfo()
{
var user = (await stateTask).User;
infoString = $"Is admin: {user.IsInRole("admin")}"; // Always False
}
}
目前有两种公认的处理方式。
首先
#1 通过调用 AddRoles 配置身份以使用角色
services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true)
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>();
#2 配置身份服务器以将角色声明放入 id 令牌和访问令牌中,并防止 JwtSecurityTokenHandler 中角色的默认映射。
services.AddIdentityServer()
.AddApiAuthorization<ApplicationUser, ApplicationDbContext>(options => {
options.IdentityResources["openid"].UserClaims.Add("role");
options.ApiResources.Single().UserClaims.Add("role");
});
// Need to do this as it maps "role" to ClaimTypes.Role and causes issues
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Remove("role");
#3 在您的 blazor 应用程序上使用 [Authorize(Roles = "admin")] 或您的应用程序定义的任何其他角色。
#4 在您受保护的资源 API 上使用 [Authorize(Roles = "admin")] 或您的应用程序定义的任何其他角色。
第二
#1 添加 Class 在客户端配置 options.UserOptions.RoleClaim
using Microsoft.AspNetCore.Components.WebAssembly.Authentication;
using Microsoft.Extensions.Options;
namespace App.Client.Services
{
public class ApiAuthorizationOptionsConfiguration
: IPostConfigureOptions<RemoteAuthenticationOptions<ApiAuthorizationProviderOptions>>
{
public void Configure(RemoteAuthenticationOptions<ApiAuthorizationProviderOptions> options)
{
options.UserOptions.RoleClaim ??= "role";
}
public void PostConfigure(string name, RemoteAuthenticationOptions<ApiAuthorizationProviderOptions> options)
{
if (string.Equals(name, Options.DefaultName))
{
Configure(options);
}
}
}
}
#2 修改Program.cs文件调用ApiAuthorizationOptionsConfiguration并配置角色声明。
using App.Client.Services;
...
namespace App.Client
{
public class Program
{
public static async Task Main(string[] args)
{
...
builder.Services.AddAuthorizationCore();
builder.Services.AddApiAuthorization();
builder.Services.TryAddEnumerable(
ServiceDescriptor.Singleton<
IPostConfigureOptions<RemoteAuthenticationOptions<ApiAuthorizationProviderOptions>>,
ApiAuthorizationOptionsConfiguration>());
...
}
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.