我的代码在 Claim base Authorization ASP.NET CORE WEB API 中有什么问题？

Question

我想在 ASP.NET CORE Web API 中使用声明基础授权，我认为我的代码是正确的，但是它对我不起作用并给我错误403 forbidden但是我使用在我的AspNetUserClaims表中具有正确声明值的 Right Token这是我的 Program.cs 代码

//Get Connection String
builder.Services.AddDbContext<AppDbContext>(opts =>
               opts.UseNpgsql(builder.Configuration["connection:connectionString"]));


builder.Services.Configure<ApplicationSettings>(builder.Configuration.GetSection("ApplicationSettings"));

builder.Services.AddMvc();


builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<AppDbContext>();

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("VIEW",
        policy => policy.RequireClaim("VIEW"));
});

builder.Services.Configure<IdentityOptions>(options =>
options.User.RequireUniqueEmail = true);



//JWT Token Setup
var key = Encoding.UTF8.GetBytes(builder.Configuration["ApplicationSettings:JWT_Secret"]);

builder.Services.AddAuthentication(x =>
{
    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(x => {
    x.RequireHttpsMetadata = false;
    x.SaveToken = false;
    x.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        ValidateIssuer = false,
        ValidateAudience = false,
        ClockSkew = TimeSpan.Zero
    };
});

这是用户登录时我的UsersLoginController，这个controller在登录成功后生成Token

        [HttpPost]
        [Route("Login")]
   
        public async Task<IActionResult> Login(LoginModel model)
        {
            var user = await _userManager.FindByNameAsync(model.UserName);
            if (user != null && await _userManager.CheckPasswordAsync(user, model.Password))
            {
                //Get role assigned to the user
                var role = await _userManager.GetRolesAsync(user);
                IdentityOptions _options = new IdentityOptions();

                var tokenDescriptor = new SecurityTokenDescriptor
                {
                    Subject = new ClaimsIdentity(new Claim[]
                    {
                        new Claim("UserID",user.Id.ToString()),
                        new Claim(_options.ClaimsIdentity.RoleClaimType,role.FirstOrDefault())
                    }),
                    Expires = DateTime.UtcNow.AddDays(1),
                    SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_appSettings.JWT_Secret)), SecurityAlgorithms.HmacSha256Signature)
                };
                var tokenHandler = new JwtSecurityTokenHandler();
                var securityToken = tokenHandler.CreateToken(tokenDescriptor);
                var token = tokenHandler.WriteToken(securityToken);
                return Ok(new { token });
            }
            else
                return BadRequest(new { message = "Username or password is incorrect." });
        }
    }

这是我的 UsersProfileDetailsController

        [HttpGet]
        [Authorize(Policy = "VIEW")]
        
        public async Task<Object> GetUserProfile()
        {
            string userId = User.Claims.First(c => c.Type == "UserID").Value;
            var user = await _userManager.FindByIdAsync(userId);
            var role = await _userManager.GetRolesAsync(user);
            return new
            {
                user.Id,
                user.FirstName,
                user.LastName,
                user.Email,
                user.UserName,
                user.PhotoPath,
                role,
    
            };
        }

现在，当我使用在表AspNetUserClaims中具有正确 Claimvalue VIEW的管理员用户登录时，它会为我生成令牌，但是当我使用此令牌从UsersProfileDetailsController访问 UserDetails 时，它会给我代码403 forbidden 。 任何人都可以帮助我如何实施 Claims base Authorization 以及我的问题是什么？ 我使用 Postman 进行测试。

Answer 1

因为您配置授权如下：

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("VIEW",
        policy => policy.RequireClaim("VIEW"));
});

如果你按F12和go定义，你会找到方法的解释

你在你的 controller 上添加了[Authorize(Policy = "VIEW")] ，如果你想成功授权，当你生成令牌时，你必须添加声明 VIEW

Subject = new ClaimsIdentity(new Claim[]
                    {
                        new Claim("UserID",user.Id.ToString()),
                        //add a new claim named View here
                        new Claim("View",.......),
                        new Claim(_options.ClaimsIdentity.RoleClaimType,role.FirstOrDefault())
                    }),