entityMap|blocks|key|31ej0|text|您可以创建自己的AuthorizationHandler来查找控制器和操作上的自定义属性，并将它们传递给HandleRequirementAsync方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|dvdla|public+abstract+class+AttributeAuthorizationHandler+:+AuthorizationHandler+where+TRequirement+:+IAuthorizationRequirement+where+TAttribute+:+Attribute
{
++++protected+override+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+TRequirement+requirement)
++++{
++++++++var+attributes+=+new+List();

++++++++var+action+=+(context.Resource+as+AuthorizationFilterContext)?.ActionDescriptor+as+ControllerActionDescriptor;
++++++++if+(action+!=+null)
++++++++{
++++++++++++attributes.AddRange(GetAttributes(action.ControllerTypeInfo.UnderlyingSystemType));
++++++++++++attributes.AddRange(GetAttributes(action.MethodInfo));
++++++++}

++++++++return+HandleRequirementAsync(context,+requirement,+attributes);
++++}

++++protected+abstract+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+TRequirement+requirement,+IEnumerable+attributes);

++++private+static+IEnumerable+GetAttributes(MemberInfo+memberInfo)
++++{
++++++++return+memberInfo.GetCustomAttributes(typeof(TAttribute),+false).Cast();
++++}
}|code-block|syntax|javascript|6c789|然后，您可以将其用于控制器或操作上所需的任何自定义属性。例如添加权限要求。只需创建自定义属性即可。|1d91t|[AttributeUsage(AttributeTargets.Class+%7C+AttributeTargets.Method,+AllowMultiple+=+true)]
public+class+PermissionAttribute+:+AuthorizeAttribute
{
++++public+string+Name+{+get;+}

++++public+PermissionAttribute(string+name)+:+base("Permission")
++++{
++++++++Name+=+name;
++++}
}|eopud|然后创建一个要求以添加到您的策略中|3jdvb|public+class+PermissionAuthorizationRequirement+:+IAuthorizationRequirement
{
++++//Add+any+custom+requirement+properties+if+you+have+them
}|encs6|然后，继承我们之前创建的AttributeAuthorizationHandler，为您的自定义属性创建AuthorizationHandler。它将传递HandleRequirementsAsync方法中所有自定义属性的IEnumerable，这些属性是从您的控制器和操作中累积而来的。|f8abu|public+class+PermissionAuthorizationHandler+:+AttributeAuthorizationHandler
{
++++protected+override+async+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+PermissionAuthorizationRequirement+requirement,+IEnumerable+attributes)
++++{
++++++++foreach+(var+permissionAttribute+in+attributes)
++++++++{
++++++++++++if+(!await+AuthorizeAsync(context.User,+permissionAttribute.Name))
++++++++++++{
++++++++++++++++return;
++++++++++++}
++++++++}

++++++++context.Succeed(requirement);
++++}

++++private+Task+AuthorizeAsync(ClaimsPrincipal+user,+string+permission)
++++{
++++++++//Implement+your+custom+user+permission+logic+here
++++}
}|3cp3s|最后，在您的Startup.cs+ConfigureServices方法中，将您的自定义AuthorizationHandler添加到服务中，并添加您的策略。|66ksg|services.AddSingleton();

++++++++services.AddAuthorization(options+=>
++++++++{
++++++++++++options.AddPolicy("Permission",+policyBuilder+=>
++++++++++++{
++++++++++++++++policyBuilder.Requirements.Add(new+PermissionAuthorizationRequirement());
++++++++++++});
++++++++});|66rrk|现在您可以简单地使用您的自定义属性来装饰您的控制器和操作。|54i9m|[Permission("AccessCustomers")]
public+class+CustomersController
{
++++[Permission("AddCustomer")]
++++IActionResult+AddCustomer([FromBody]+Customer+customer)
++++{
++++++++//Add+customer
++++}
}^0|0|0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|11|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|12|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|13|9|@]|A|@]|B|$]]|$2|J|4|K|6|E|8|14|9|@]|A|@]|B|$F|G]]|$2|L|4|M|6|7|8|15|9|@]|A|@]|B|$]]|$2|N|4|O|6|E|8|16|9|@]|A|@]|B|$F|G]]|$2|P|4|Q|6|7|8|17|9|@]|A|@]|B|$]]|$2|R|4|S|6|E|8|18|9|@]|A|@]|B|$F|G]]|$2|T|4|U|6|7|8|19|9|@]|A|@]|B|$]]|$2|V|4|W|6|E|8|1A|9|@]|A|@]|B|$F|G]]|$2|X|4|Y|6|7|8|1B|9|@]|A|@]|B|$]]|$2|Z|4|10|6|E|8|1C|9|@]|A|@]|B|$F|G]]]]

You can create your own AuthorizationHandler that will find custom attributes on your Controllers and Actions, and pass them to the HandleRequirementAsync method.

<pre><code>public abstract class AttributeAuthorizationHandler&lt;TRequirement, TAttribute&gt; : AuthorizationHandler&lt;TRequirement&gt; where TRequirement : IAuthorizationRequirement where TAttribute : Attribute
{
 protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement)
 {
 var attributes = new List&lt;TAttribute&gt;();

 var action = (context.Resource as AuthorizationFilterContext)?.ActionDescriptor as ControllerActionDescriptor;
 if (action != null)
 {
 attributes.AddRange(GetAttributes(action.ControllerTypeInfo.UnderlyingSystemType));
 attributes.AddRange(GetAttributes(action.MethodInfo));
 }

 return HandleRequirementAsync(context, requirement, attributes);
 }

 protected abstract Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement, IEnumerable&lt;TAttribute&gt; attributes);

 private static IEnumerable&lt;TAttribute&gt; GetAttributes(MemberInfo memberInfo)
 {
 return memberInfo.GetCustomAttributes(typeof(TAttribute), false).Cast&lt;TAttribute&gt;();
 }
}
</code></pre>

Then you can use it for any custom attributes you need on your controllers or actions. For example to add permission requirements. Just create your custom attribute.

<pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
public class PermissionAttribute : AuthorizeAttribute
{
 public string Name { get; }

 public PermissionAttribute(string name) : base("Permission")
 {
 Name = name;
 }
}
</code></pre>

Then create a Requirement to add to your Policy

<pre><code>public class PermissionAuthorizationRequirement : IAuthorizationRequirement
{
 //Add any custom requirement properties if you have them
}
</code></pre>

Then create the AuthorizationHandler for your custom attribute, inheriting the AttributeAuthorizationHandler that we created earlier. It will be passed an IEnumerable for all your custom attributes in the HandleRequirementsAsync method, accumulated from your Controller and Action.

<pre><code>public class PermissionAuthorizationHandler : AttributeAuthorizationHandler&lt;PermissionAuthorizationRequirement, PermissionAttribute&gt;
{
 protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionAuthorizationRequirement requirement, IEnumerable&lt;PermissionAttribute&gt; attributes)
 {
 foreach (var permissionAttribute in attributes)
 {
 if (!await AuthorizeAsync(context.User, permissionAttribute.Name))
 {
 return;
 }
 }

 context.Succeed(requirement);
 }

 private Task&lt;bool&gt; AuthorizeAsync(ClaimsPrincipal user, string permission)
 {
 //Implement your custom user permission logic here
 }
}
</code></pre>

And finally, in your Startup.cs ConfigureServices method, add your custom AuthorizationHandler to the services, and add your Policy.

<pre><code> services.AddSingleton&lt;IAuthorizationHandler, PermissionAuthorizationHandler&gt;();

 services.AddAuthorization(options =&gt;
 {
 options.AddPolicy("Permission", policyBuilder =&gt;
 {
 policyBuilder.Requirements.Add(new PermissionAuthorizationRequirement());
 });
 });
</code></pre>

Now you can simply decorate your Controllers and Actions with your custom attribute.

<pre><code>[Permission("AccessCustomers")]
public class CustomersController
{
 [Permission("AddCustomer")]
 IActionResult AddCustomer([FromBody] Customer customer)
 {
 //Add customer
 }
}
</code></pre>

entityMap|blocks|key|baqcu|text|基于Derek+Greer|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3g0vk|太棒了|9s74q|答案是，我用枚举做到了这一点。|c7fm0|下面是我的代码示例：|5j05i|public+enum+PermissionItem
{
++++User,
++++Product,
++++Contact,
++++Review,
++++Client
}

public+enum+PermissionAction
{
++++Read,
++++Create,
}


public+class+AuthorizeAttribute+:+TypeFilterAttribute
{
++++public+AuthorizeAttribute(PermissionItem+item,+PermissionAction+action)
++++:+base(typeof(AuthorizeActionFilter))
++++{
++++++++Arguments+=+new+object[]+{+item,+action+};
++++}
}

public+class+AuthorizeActionFilter+:+IAuthorizationFilter
{
++++private+readonly+PermissionItem+_item;
++++private+readonly+PermissionAction+_action;
++++public+AuthorizeActionFilter(PermissionItem+item,+PermissionAction+action)
++++{
++++++++_item+=+item;
++++++++_action+=+action;
++++}
++++public+void+OnAuthorization(AuthorizationFilterContext+context)
++++{
++++++++bool+isAuthorized+=+MumboJumboFunction(context.HttpContext.User,+_item,+_action);+//+:)

++++++++if+(!isAuthorized)
++++++++{
++++++++++++context.Result+=+new+ForbidResult();
++++++++}
++++}
}

public+class+UserController+:+BaseController
{
++++private+readonly+DbContext+_context;

++++public+UserController(+DbContext+context)+:
++++++++base()
++++{
++++++++_logger+=+logger;
++++}

++++[Authorize(PermissionItem.User,+PermissionAction.Read)]
++++public+async+Task+Index()
++++{
++++++++return+View(await+_context.User.ToListAsync());
++++}
}|code-block|syntax|javascript^0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|N|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|O|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|P|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|Q|9|@]|A|@]|B|$]]|$2|I|4|J|6|K|8|R|9|@]|A|@]|B|$L|M]]]]

Based on Derek Greer GREAT answer, i did it with enums.

Here is an example of my code:

<pre><code>public enum PermissionItem
{
 User,
 Product,
 Contact,
 Review,
 Client
}

public enum PermissionAction
{
 Read,
 Create,
}


public class AuthorizeAttribute : TypeFilterAttribute
{
 public AuthorizeAttribute(PermissionItem item, PermissionAction action)
 : base(typeof(AuthorizeActionFilter))
 {
 Arguments = new object[] { item, action };
 }
}

public class AuthorizeActionFilter : IAuthorizationFilter
{
 private readonly PermissionItem _item;
 private readonly PermissionAction _action;
 public AuthorizeActionFilter(PermissionItem item, PermissionAction action)
 {
 _item = item;
 _action = action;
 }
 public void OnAuthorization(AuthorizationFilterContext context)
 {
 bool isAuthorized = MumboJumboFunction(context.HttpContext.User, _item, _action); // :)

 if (!isAuthorized)
 {
 context.Result = new ForbidResult();
 }
 }
}

public class UserController : BaseController
{
 private readonly DbContext _context;

 public UserController( DbContext context) :
 base()
 {
 _logger = logger;
 }

 [Authorize(PermissionItem.User, PermissionAction.Read)]
 public async Task&lt;IActionResult&gt; Index()
 {
 return View(await _context.User.ToListAsync());
 }
}
</code></pre>

entityMap|blocks|key|fi5q3|text|似乎使用ASP.NET+Core2，您可以再次继承|type|unstyled|depth|inlineStyleRanges|entityRanges|data|9jvf6|，您只需要实现|c7g49|(或|2tdeg|)：|1tpgl|[AttributeUsage(AttributeTargets.Class+%7C+AttributeTargets.Method,+AllowMultiple+=+true,+Inherited+=+true)]
public+class+CustomAuthorizeAttribute+:+AuthorizeAttribute,+IAuthorizationFilter
{
++++private+readonly+string+_someFilterParameter;

++++public+CustomAuthorizeAttribute(string+someFilterParameter)
++++{
++++++++_someFilterParameter+=+someFilterParameter;
++++}

++++public+void+OnAuthorization(AuthorizationFilterContext+context)
++++{
++++++++var+user+=+context.HttpContext.User;

++++++++if+(!user.Identity.IsAuthenticated)
++++++++{
++++++++++++//+it+isn't+needed+to+set+unauthorized+result+
++++++++++++//+as+the+base+class+already+requires+the+user+to+be+authenticated
++++++++++++//+this+also+makes+redirect+to+a+login+page+work+properly
++++++++++++//+context.Result+=+new+UnauthorizedResult();
++++++++++++return;
++++++++}

++++++++//+you+can+also+use+registered+services
++++++++var+someService+=+context.HttpContext.RequestServices.GetService();

++++++++var+isAuthorized+=+someService.IsUserAuthorized(user.Identity.Name,+_someFilterParameter);
++++++++if+(!isAuthorized)
++++++++{
++++++++++++context.Result+=+new+StatusCodeResult((int)System.Net.HttpStatusCode.Forbidden);
++++++++++++return;
++++++++}
++++}
}|code-block|syntax|javascript^0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|N|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|O|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|P|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|Q|9|@]|A|@]|B|$]]|$2|I|4|J|6|K|8|R|9|@]|A|@]|B|$L|M]]]]

It seems that with ASP.NET Core 2, you can again inherit <code>AuthorizeAttribute</code>, you just need to also implement <code>IAuthorizationFilter</code> (or <code>IAsyncAuthorizationFilter</code>):

<pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
public class CustomAuthorizeAttribute : AuthorizeAttribute, IAuthorizationFilter
{
 private readonly string _someFilterParameter;

 public CustomAuthorizeAttribute(string someFilterParameter)
 {
 _someFilterParameter = someFilterParameter;
 }

 public void OnAuthorization(AuthorizationFilterContext context)
 {
 var user = context.HttpContext.User;

 if (!user.Identity.IsAuthenticated)
 {
 // it isn't needed to set unauthorized result 
 // as the base class already requires the user to be authenticated
 // this also makes redirect to a login page work properly
 // context.Result = new UnauthorizedResult();
 return;
 }

 // you can also use registered services
 var someService = context.HttpContext.RequestServices.GetService&lt;ISomeService&gt;();

 var isAuthorized = someService.IsUserAuthorized(user.Identity.Name, _someFilterParameter);
 if (!isAuthorized)
 {
 context.Result = new StatusCodeResult((int)System.Net.HttpStatusCode.Forbidden);
 return;
 }
 }
}
</code></pre>

entityMap|blocks|key|lmer|text|如果任何人只想在授权阶段使用当前的安全实践验证一个持有者令牌，您可以，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|d0qgk|将其添加到Startup/ConfigureServices|6lf8v|services.AddSingleton();
++++services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer();

++++services.AddAuthorization(options+=>+options.AddPolicy("Bearer",
++++++++policy+=>+policy.AddRequirements(new+BearerRequirement())
++++++++)
++++);|code-block|syntax|javascript|7e2g4|在你的代码库里，|4sg73|public+class+BearerRequirement+:+IAuthorizationRequirement
{
++++public+async+Task+IsTokenValid(SomeValidationContext+context,+string+token)
++++{
++++++++//+here+you+can+check+if+the+token+received+is+valid+
++++++++return+true;
++++}
}

public+class+BearerAuthorizationHandler+:+AuthorizationHandler+
{

++++public+BearerAuthorizationHandler(SomeValidationContext+thatYouCanInject)
++++{
+++++++...
++++}

++++protected+override+async+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+BearerRequirement+requirement)
++++{
++++++++var+authFilterCtx+=+(Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext)context.Resource;
++++++++string+authHeader+=+authFilterCtx.HttpContext.Request.Headers["Authorization"];
++++++++if+(authHeader+!=+null+&&+authHeader.Contains("Bearer"))
++++++++{
++++++++++++var+token+=+authHeader.Replace("Bearer+",+string.Empty);
++++++++++++if+(await+requirement.IsTokenValid(thatYouCanInject,+token))
++++++++++++{
++++++++++++++++context.Succeed(requirement);
++++++++++++}
++++++++}
++++}
}|39k47|如果代码不能到达|3o6cg|它无论如何都会失败(401)。|9k0jk|然后在你的控制器中你可以使用|9f8m2|[Authorize(Policy+=+"Bearer",+AuthenticationSchemes+=+JwtBearerDefaults.AuthenticationScheme)]^0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|V|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|W|9|@]|A|@]|B|$]]|$2|E|4|F|6|G|8|X|9|@]|A|@]|B|$H|I]]|$2|J|4|K|6|7|8|Y|9|@]|A|@]|B|$]]|$2|L|4|M|6|G|8|Z|9|@]|A|@]|B|$H|I]]|$2|N|4|O|6|7|8|10|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|11|9|@]|A|@]|B|$]]|$2|R|4|S|6|7|8|12|9|@]|A|@]|B|$]]|$2|T|4|U|6|G|8|13|9|@]|A|@]|B|$H|I]]]]

If anyone just wants to validate a bearer token in the authorize phase using the current security practices you can,

add this to your Startup/ConfigureServices

<pre><code> services.AddSingleton&lt;IAuthorizationHandler, BearerAuthorizationHandler&gt;();
 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer();

 services.AddAuthorization(options =&gt; options.AddPolicy("Bearer",
 policy =&gt; policy.AddRequirements(new BearerRequirement())
 )
 );
</code></pre>

and this in your codebase,

<pre><code>public class BearerRequirement : IAuthorizationRequirement
{
 public async Task&lt;bool&gt; IsTokenValid(SomeValidationContext context, string token)
 {
 // here you can check if the token received is valid 
 return true;
 }
}

public class BearerAuthorizationHandler : AuthorizationHandler&lt;BearerRequirement&gt; 
{

 public BearerAuthorizationHandler(SomeValidationContext thatYouCanInject)
 {
 ...
 }

 protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, BearerRequirement requirement)
 {
 var authFilterCtx = (Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext)context.Resource;
 string authHeader = authFilterCtx.HttpContext.Request.Headers["Authorization"];
 if (authHeader != null &amp;&amp; authHeader.Contains("Bearer"))
 {
 var token = authHeader.Replace("Bearer ", string.Empty);
 if (await requirement.IsTokenValid(thatYouCanInject, token))
 {
 context.Succeed(requirement);
 }
 }
 }
}
</code></pre>

If the code doesn't reach <code>context.Succeed(...)</code> it will Fail anyway (401).

And then in your controllers you can use

<pre><code> [Authorize(Policy = "Bearer", AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
</code></pre>

entityMap|blocks|key|99bpf|text|在我们的应用程序中进行授权。我们必须根据在授权属性中传递的参数来调用服务。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|bl32d|例如，如果我们想检查登录的医生是否可以查看患者的预约，我们将传递"View|dms7p|_|bgo7v|Appointment“来定制授权属性，并在DB服务中检查权限，我们将根据结果对其进行验证。以下是此场景代码：|b13ji|public+class+PatientAuthorizeAttribute+:+TypeFilterAttribute
++++{
++++public+PatientAuthorizeAttribute(params+PatientAccessRights[]+right)+:+base(typeof(AuthFilter))+//PatientAccessRights+is+an+enum
++++{
++++++++Arguments+=+new+object[]+{+right+};
++++}

++++private+class+AuthFilter+:+IActionFilter
++++{
++++++++PatientAccessRights[]+right;

++++++++IAuthService+authService;

++++++++public+AuthFilter(IAuthService+authService,+PatientAccessRights[]+right)
++++++++{
++++++++++++this.right+=+right;
++++++++++++this.authService+=+authService;
++++++++}

++++++++public+void+OnActionExecuted(ActionExecutedContext+context)
++++++++{
++++++++}

++++++++public+void+OnActionExecuting(ActionExecutingContext+context)
++++++++{
++++++++++++var+allparameters+=+context.ActionArguments.Values;
++++++++++++if+(allparameters.Count()+==+1)
++++++++++++{
++++++++++++++++var+param+=+allparameters.First();
++++++++++++++++if+(typeof(IPatientRequest).IsAssignableFrom(param.GetType()))
++++++++++++++++{
++++++++++++++++++++IPatientRequest+patientRequestInfo+=+(IPatientRequest)param;
++++++++++++++++++++PatientAccessRequest+userAccessRequest+=+new+PatientAccessRequest();
++++++++++++++++++++userAccessRequest.Rights+=+right;
++++++++++++++++++++userAccessRequest.MemberID+=+patientRequestInfo.PatientID;
++++++++++++++++++++var+result+=+authService.CheckUserPatientAccess(userAccessRequest).Result;+//this+calls+DB+service+to+check+from+DB
++++++++++++++++++++if+(result.Status+==+ReturnType.Failure)
++++++++++++++++++++{
++++++++++++++++++++++++//TODO:+return+apirepsonse
++++++++++++++++++++++++context.Result+=+new+StatusCodeResult((int)System.Net.HttpStatusCode.Forbidden);
++++++++++++++++++++}
++++++++++++++++}
++++++++++++++++else
++++++++++++++++{
++++++++++++++++++++throw+new+AppSystemException("PatientAuthorizeAttribute+not+supported");
++++++++++++++++}
++++++++++++}
++++++++++++else
++++++++++++{
++++++++++++++++throw+new+AppSystemException("PatientAuthorizeAttribute+not+supported");
++++++++++++}
++++++++}
++++}
}|code-block|syntax|javascript|cuemo|在API操作上，我们像这样使用它：|cb9ci|[PatientAuthorize(PatientAccessRights.PATIENT_VIEW_APPOINTMENTS)]+//this+is+enum,+we+can+pass+multiple
++++[HttpPost]
++++public+SomeReturnType+ViewAppointments()
++++{

++++}^0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|R|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|S|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|T|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|U|9|@]|A|@]|B|$]]|$2|I|4|J|6|K|8|V|9|@]|A|@]|B|$L|M]]|$2|N|4|O|6|7|8|W|9|@]|A|@]|B|$]]|$2|P|4|Q|6|K|8|X|9|@]|A|@]|B|$L|M]]]]

For authorization in our app. We had to call a service based on the parameters passed in authorization attribute.

For example, if we want to check if logged in doctor can view patient appointments we will pass "View_Appointment" to custom authorize attribute and check that right in DB service and based on results we will athorize. Here is the code for this scenario:

<pre><code> public class PatientAuthorizeAttribute : TypeFilterAttribute
 {
 public PatientAuthorizeAttribute(params PatientAccessRights[] right) : base(typeof(AuthFilter)) //PatientAccessRights is an enum
 {
 Arguments = new object[] { right };
 }

 private class AuthFilter : IActionFilter
 {
 PatientAccessRights[] right;

 IAuthService authService;

 public AuthFilter(IAuthService authService, PatientAccessRights[] right)
 {
 this.right = right;
 this.authService = authService;
 }

 public void OnActionExecuted(ActionExecutedContext context)
 {
 }

 public void OnActionExecuting(ActionExecutingContext context)
 {
 var allparameters = context.ActionArguments.Values;
 if (allparameters.Count() == 1)
 {
 var param = allparameters.First();
 if (typeof(IPatientRequest).IsAssignableFrom(param.GetType()))
 {
 IPatientRequest patientRequestInfo = (IPatientRequest)param;
 PatientAccessRequest userAccessRequest = new PatientAccessRequest();
 userAccessRequest.Rights = right;
 userAccessRequest.MemberID = patientRequestInfo.PatientID;
 var result = authService.CheckUserPatientAccess(userAccessRequest).Result; //this calls DB service to check from DB
 if (result.Status == ReturnType.Failure)
 {
 //TODO: return apirepsonse
 context.Result = new StatusCodeResult((int)System.Net.HttpStatusCode.Forbidden);
 }
 }
 else
 {
 throw new AppSystemException("PatientAuthorizeAttribute not supported");
 }
 }
 else
 {
 throw new AppSystemException("PatientAuthorizeAttribute not supported");
 }
 }
 }
}
</code></pre>

And on API action we use it like this:

<pre><code> [PatientAuthorize(PatientAccessRights.PATIENT_VIEW_APPOINTMENTS)] //this is enum, we can pass multiple
 [HttpPost]
 public SomeReturnType ViewAppointments()
 {

 }
</code></pre>

entityMap|blocks|key|chh3d|text|现代的方式是AuthenticationHandlers|type|unstyled|depth|inlineStyleRanges|entityRanges|data|69opm|在startup.cs中添加|7hvur|services.AddAuthentication("BasicAuthentication").AddScheme("BasicAuthentication",+null);

public+class+BasicAuthenticationHandler+:+AuthenticationHandler
++++{
++++++++private+readonly+IUserService+_userService;

++++++++public+BasicAuthenticationHandler(
++++++++++++IOptionsMonitor+options,
++++++++++++ILoggerFactory+logger,
++++++++++++UrlEncoder+encoder,
++++++++++++ISystemClock+clock,
++++++++++++IUserService+userService)
++++++++++++:+base(options,+logger,+encoder,+clock)
++++++++{
++++++++++++_userService+=+userService;
++++++++}

++++++++protected+override+async+Task+HandleAuthenticateAsync()
++++++++{
++++++++++++if+(!Request.Headers.ContainsKey("Authorization"))
++++++++++++++++return+AuthenticateResult.Fail("Missing+Authorization+Header");

++++++++++++User+user+=+null;
++++++++++++try
++++++++++++{
++++++++++++++++var+authHeader+=+AuthenticationHeaderValue.Parse(Request.Headers["Authorization"]);
++++++++++++++++var+credentialBytes+=+Convert.FromBase64String(authHeader.Parameter);
++++++++++++++++var+credentials+=+Encoding.UTF8.GetString(credentialBytes).Split(new[]+{+':'+},+2);
++++++++++++++++var+username+=+credentials[0];
++++++++++++++++var+password+=+credentials[1];
++++++++++++++++user+=+await+_userService.Authenticate(username,+password);
++++++++++++}
++++++++++++catch
++++++++++++{
++++++++++++++++return+AuthenticateResult.Fail("Invalid+Authorization+Header");
++++++++++++}

++++++++++++if+(user+==+null)
++++++++++++++++return+AuthenticateResult.Fail("Invalid+User-name+or+Password");

++++++++++++var+claims+=+new[]+{
++++++++++++++++new+Claim(ClaimTypes.NameIdentifier,+user.Id.ToString()),
++++++++++++++++new+Claim(ClaimTypes.Name,+user.Username),
++++++++++++};
++++++++++++var+identity+=+new+ClaimsIdentity(claims,+Scheme.Name);
++++++++++++var+principal+=+new+ClaimsPrincipal(identity);
++++++++++++var+ticket+=+new+AuthenticationTicket(principal,+Scheme.Name);

++++++++++++return+AuthenticateResult.Success(ticket);
++++++++}
++++}|code-block|syntax|javascript|fk7r0|IUserService是您在拥有用户名和密码的情况下提供的服务。基本上，它返回一个user类，您可以使用它来映射您的声明。|cdubj|var+claims+=+new[]+{
++++++++++++++++new+Claim(ClaimTypes.NameIdentifier,+user.Id.ToString()),
++++++++++++++++new+Claim(ClaimTypes.Name,+user.Username),
++++++++++++};|243sd|然后你可以查询这些声明和你映射的任何数据，有相当多，看看ClaimTypes类|456h9|您可以在扩展方法中使用它来获取任何映射|11p4u|public+int?+GetUserId()
{
+++if+(context.User.Identity.IsAuthenticated)
++++{
+++++++var+id=context.User.FindFirst(ClaimTypes.NameIdentifier);
+++++++if+(!(id+is+null)+&&+int.TryParse(id.Value,+out+var+userId))
++++++++++++return+userId;
+++++}
++++++return+new+Nullable();
+}|477vm|我认为这种新方法比这里所示的旧方法更好，两者都有效。|1fi4v|public+class+BasicAuthenticationAttribute+:+AuthorizationFilterAttribute
{
++++public+override+void+OnAuthorization(HttpActionContext+actionContext)
++++{
++++++++if+(actionContext.Request.Headers.Authorization+!=+null)
++++++++{
++++++++++++var+authToken+=+actionContext.Request.Headers.Authorization.Parameter;
++++++++++++//+decoding+authToken+we+get+decode+value+in+'Username:Password'+format
++++++++++++var+decodeauthToken+=+System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(authToken));
++++++++++++//+spliting+decodeauthToken+using+':'
++++++++++++var+arrUserNameandPassword+=+decodeauthToken.Split(':');
++++++++++++//+at+0th+postion+of+array+we+get+username+and+at+1st+we+get+password
++++++++++++if+(IsAuthorizedUser(arrUserNameandPassword[0],+arrUserNameandPassword[1]))
++++++++++++{
++++++++++++++++//+setting+current+principle
++++++++++++++++Thread.CurrentPrincipal+=+new+GenericPrincipal(new+GenericIdentity(arrUserNameandPassword[0]),+null);
++++++++++++}
++++++++++++else
++++++++++++{
++++++++++++++++actionContext.Response+=+actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
++++++++++++}
++++++++}
++++++++else
++++++++{
++++++++++++actionContext.Response+=+actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
++++++++}
++++}

++++public+static+bool+IsAuthorizedUser(string+Username,+string+Password)
++++{
++++++++//+In+this+method+we+can+handle+our+database+logic+here...
++++++++return+Username.Equals("test")+&&+Password+==+"test";
++++}
}^0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|X|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|Y|9|@]|A|@]|B|$]]|$2|E|4|F|6|G|8|Z|9|@]|A|@]|B|$H|I]]|$2|J|4|K|6|7|8|10|9|@]|A|@]|B|$]]|$2|L|4|M|6|G|8|11|9|@]|A|@]|B|$H|I]]|$2|N|4|O|6|7|8|12|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|13|9|@]|A|@]|B|$]]|$2|R|4|S|6|G|8|14|9|@]|A|@]|B|$H|I]]|$2|T|4|U|6|7|8|15|9|@]|A|@]|B|$]]|$2|V|4|W|6|G|8|16|9|@]|A|@]|B|$H|I]]]]

The modern way is AuthenticationHandlers
in startup.cs add
<pre><code>services.AddAuthentication(&quot;BasicAuthentication&quot;).AddScheme&lt;AuthenticationSchemeOptions, BasicAuthenticationHandler&gt;(&quot;BasicAuthentication&quot;, null);

public class BasicAuthenticationHandler : AuthenticationHandler&lt;AuthenticationSchemeOptions&gt;
 {
 private readonly IUserService _userService;

 public BasicAuthenticationHandler(
 IOptionsMonitor&lt;AuthenticationSchemeOptions&gt; options,
 ILoggerFactory logger,
 UrlEncoder encoder,
 ISystemClock clock,
 IUserService userService)
 : base(options, logger, encoder, clock)
 {
 _userService = userService;
 }

 protected override async Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
 {
 if (!Request.Headers.ContainsKey(&quot;Authorization&quot;))
 return AuthenticateResult.Fail(&quot;Missing Authorization Header&quot;);

 User user = null;
 try
 {
 var authHeader = AuthenticationHeaderValue.Parse(Request.Headers[&quot;Authorization&quot;]);
 var credentialBytes = Convert.FromBase64String(authHeader.Parameter);
 var credentials = Encoding.UTF8.GetString(credentialBytes).Split(new[] { ':' }, 2);
 var username = credentials[0];
 var password = credentials[1];
 user = await _userService.Authenticate(username, password);
 }
 catch
 {
 return AuthenticateResult.Fail(&quot;Invalid Authorization Header&quot;);
 }

 if (user == null)
 return AuthenticateResult.Fail(&quot;Invalid User-name or Password&quot;);

 var claims = new[] {
 new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
 new Claim(ClaimTypes.Name, user.Username),
 };
 var identity = new ClaimsIdentity(claims, Scheme.Name);
 var principal = new ClaimsPrincipal(identity);
 var ticket = new AuthenticationTicket(principal, Scheme.Name);

 return AuthenticateResult.Success(ticket);
 }
 }
</code></pre>
IUserService is a service that you make where you have user name and password.
basically it returns a user class that you use to map your claims on.
<pre><code>var claims = new[] {
 new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
 new Claim(ClaimTypes.Name, user.Username),
 }; 
</code></pre>
Then you can query these claims and her any data you mapped, ther are quite a few, have a look at ClaimTypes class
you can use this in an extension method an get any of the mappings
<pre><code>public int? GetUserId()
{
 if (context.User.Identity.IsAuthenticated)
 {
 var id=context.User.FindFirst(ClaimTypes.NameIdentifier);
 if (!(id is null) &amp;&amp; int.TryParse(id.Value, out var userId))
 return userId;
 }
 return new Nullable&lt;int&gt;();
 }
</code></pre>
This new way, i think is better than the old way as shown here, both work
<pre><code>public class BasicAuthenticationAttribute : AuthorizationFilterAttribute
{
 public override void OnAuthorization(HttpActionContext actionContext)
 {
 if (actionContext.Request.Headers.Authorization != null)
 {
 var authToken = actionContext.Request.Headers.Authorization.Parameter;
 // decoding authToken we get decode value in 'Username:Password' format
 var decodeauthToken = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(authToken));
 // spliting decodeauthToken using ':'
 var arrUserNameandPassword = decodeauthToken.Split(':');
 // at 0th postion of array we get username and at 1st we get password
 if (IsAuthorizedUser(arrUserNameandPassword[0], arrUserNameandPassword[1]))
 {
 // setting current principle
 Thread.CurrentPrincipal = new GenericPrincipal(new GenericIdentity(arrUserNameandPassword[0]), null);
 }
 else
 {
 actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
 }
 }
 else
 {
 actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
 }
 }

 public static bool IsAuthorizedUser(string Username, string Password)
 {
 // In this method we can handle our database logic here...
 return Username.Equals(&quot;test&quot;) &amp;&amp; Password == &quot;test&quot;;
 }
}
</code></pre>

entityMap|blocks|key|dtbek|text|在撰写本文时，我相信这可以通过asp.net+Core2及更高版本中的IClaimsTransformation接口来实现。我刚刚实现了一个概念证明，可以分享到这里。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42jfq|public+class+PrivilegesToClaimsTransformer+:+IClaimsTransformation
{
++++private+readonly+IPrivilegeProvider+privilegeProvider;
++++public+const+string+DidItClaim+=+"http://foo.bar/privileges/resolved";

++++public+PrivilegesToClaimsTransformer(IPrivilegeProvider+privilegeProvider)
++++{
++++++++this.privilegeProvider+=+privilegeProvider;
++++}

++++public+async+Task+TransformAsync(ClaimsPrincipal+principal)
++++{
++++++++if+(principal.Identity+is+ClaimsIdentity+claimer)
++++++++{
++++++++++++if+(claimer.HasClaim(DidItClaim,+bool.TrueString))
++++++++++++{
++++++++++++++++return+principal;
++++++++++++}

++++++++++++var+privileges+=+await+this.privilegeProvider.GetPrivileges(+...+);
++++++++++++claimer.AddClaim(new+Claim(DidItClaim,+bool.TrueString));

++++++++++++foreach+(var+privilegeAsRole+in+privileges)
++++++++++++{
++++++++++++++++claimer.AddClaim(new+Claim(ClaimTypes.Role+/*"http://schemas.microsoft.com/ws/2008/06/identity/claims/role"+*/,+privilegeAsRole));
++++++++++++}
++++++++}

++++++++return+principal;
++++}
}|code-block|syntax|javascript|4mqgc|要在您的控制器中使用它，只需添加适当的|52no5|你的方法。|8oa1k|[HttpGet]
[Route("poc")]
[Authorize(Roles+=+"plugh,blast")]
public+JsonResult+PocAuthorization()
{
++++var+result+=+Json(new
++++{
++++++++when+=+DateTime.UtcNow,
++++});

++++result.StatusCode+=+(int)HttpStatusCode.OK;

++++return+result;
}|71qig|在我们的例子中，每个请求都包含一个Authorization头，它是一个JWT。这是原型，我相信我们下周将在我们的生产系统中做一些非常接近这一点的事情。|e58gu|未来的投票者，请在投票时考虑写作日期。到今天为止，这个|92k14|™您可能需要在实现中进行更多的错误处理和日志记录。^0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|T|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|U|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|V|9|@]|A|@]|B|$]]|$2|J|4|K|6|7|8|W|9|@]|A|@]|B|$]]|$2|L|4|M|6|E|8|X|9|@]|A|@]|B|$F|G]]|$2|N|4|O|6|7|8|Y|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|Z|9|@]|A|@]|B|$]]|$2|R|4|S|6|7|8|10|9|@]|A|@]|B|$]]]]

As of this writing I believe this can be accomplished with the IClaimsTransformation interface in asp.net core 2 and above. I just implemented a proof of concept which is sharable enough to post here.

<pre><code>public class PrivilegesToClaimsTransformer : IClaimsTransformation
{
 private readonly IPrivilegeProvider privilegeProvider;
 public const string DidItClaim = "http://foo.bar/privileges/resolved";

 public PrivilegesToClaimsTransformer(IPrivilegeProvider privilegeProvider)
 {
 this.privilegeProvider = privilegeProvider;
 }

 public async Task&lt;ClaimsPrincipal&gt; TransformAsync(ClaimsPrincipal principal)
 {
 if (principal.Identity is ClaimsIdentity claimer)
 {
 if (claimer.HasClaim(DidItClaim, bool.TrueString))
 {
 return principal;
 }

 var privileges = await this.privilegeProvider.GetPrivileges( ... );
 claimer.AddClaim(new Claim(DidItClaim, bool.TrueString));

 foreach (var privilegeAsRole in privileges)
 {
 claimer.AddClaim(new Claim(ClaimTypes.Role /*"http://schemas.microsoft.com/ws/2008/06/identity/claims/role" */, privilegeAsRole));
 }
 }

 return principal;
 }
}
</code></pre>

To use this in your Controller just add an appropriate <code>[Authorize(Roles="whatever")]</code> to your methods.

<pre><code>[HttpGet]
[Route("poc")]
[Authorize(Roles = "plugh,blast")]
public JsonResult PocAuthorization()
{
 var result = Json(new
 {
 when = DateTime.UtcNow,
 });

 result.StatusCode = (int)HttpStatusCode.OK;

 return result;
}
</code></pre>

In our case every request includes an Authorization header that is a JWT. This is the prototype and I believe we will do something super close to this in our production system next week.

Future voters, consider the date of writing when you vote. As of today, this <code>works on my machine.</code>™ You will probably want more error handling and logging on your implementation.

entityMap|blocks|key|5abms|text|被接受的答案(|type|unstyled|depth|inlineStyleRanges|entityRanges|data|f9r7k|https://stackoverflow.com/a/41348219/4974715|3jdej|)实际上是不可维护的或不合适的，因为"CanReadResource“被用作索赔(但实际上应该是一项政策，国际海事组织)。答案中的方法在使用的方式上是不好的，因为如果一个动作方法需要许多不同的声明设置，那么使用该答案，您将不得不重复编写类似于……的内容。|6l62i|[ClaimRequirement(MyClaimTypes.Permission,+"CanReadResource")]+
[ClaimRequirement(MyClaimTypes.AnotherPermision,+"AnotherClaimVaue")]
//and+etc.+on+a+single+action.|code-block|syntax|javascript|9l8sa|所以，想象一下这需要多少编码。理想情况下，"CanReadResource“应该是一种策略，它使用许多声明来确定用户是否可以读取资源。|eeu57|我所做的是将我的策略创建为枚举，然后循环并设置需求，如下所示……|2327h|services.AddAuthorization(authorizationOptions+=>
++++++++{
++++++++++++foreach+(var+policyString+in+Enum.GetNames(typeof(Enumerations.Security.Policy)))
++++++++++++{
++++++++++++++++authorizationOptions.AddPolicy(
++++++++++++++++++++policyString,
++++++++++++++++++++authorizationPolicyBuilder+=>+authorizationPolicyBuilder.Requirements.Add(new+DefaultAuthorizationRequirement((Enumerations.Security.Policy)Enum.Parse(typeof(Enumerations.Security.Policy),+policyWrtString),+DateTime.UtcNow)));

++++++/*+Note+that+thisn+does+not+stop+you+from+
++++++++++configuring+policies+directly+against+a+username,+claims,+roles,+etc.+You+can+do+the+usual.
+++++*/
++++++++++++}
++++++++});|ckgd5|DefaultAuthorizationRequirement类看起来像...|4q5u0|public+class+DefaultAuthorizationRequirement+:+IAuthorizationRequirement
{
++++public+Enumerations.Security.Policy+Policy+{get;+set;}+//This+is+a+mere+enumeration+whose+code+is+not+shown.
++++public+DateTime+DateTimeOfSetup+{get;+set;}+//Just+in+case+you+have+to+know+when+the+app+started+up.+And+you+may+want+to+log+out+a+user+if+their+profile+was+modified+after+this+date-time,+etc.
}

public+class+DefaultAuthorizationHandler+:+AuthorizationHandler
{
++++private+IAServiceToUse+_aServiceToUse;

++++public+DefaultAuthorizationHandler(
++++++++IAServiceToUse+aServiceToUse
++++++++)
++++{
++++++++_aServiceToUse+=+aServiceToUse;
++++}

++++protected+async+override+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+DefaultAuthorizationRequirement+requirement)
++++{
++++++++/*Here,+you+can+quickly+check+a+data+source+or+Web+API+or+etc.+
+++++++++++to+know+the+latest+date-time+of+the+user's+profile+modification...
++++++++*/
++++++++if+(_aServiceToUse.GetDateTimeOfLatestUserProfileModication+>+requirement.DateTimeOfSetup)
++++++++{
++++++++++++context.Fail();+/*Because+any+modifications+to+user+information,+
++++++++++++e.g.+if+the+user+used+another+browser+or+if+by+Admin+modification,+
++++++++++++the+claims+of+the+user+in+this+session+cannot+be+guaranteed+to+be+reliable.
++++++++++++*/
++++++++++++return;
++++++++}

++++++++bool+shouldSucceed+=+false;+//This+should+first+be+false,+because+context.Succeed(...)+has+to+only+be+called+if+the+requirement+specifically+succeeds.

++++++++bool+shouldFail+=+false;+/*This+should+first+be+false,+because+context.Fail()+
++++++++doesn't+have+to+be+called+if+there's+no+security+breach.
++++++++*/

++++++++//+You+can+do+anything.
++++++++await+doAnythingAsync();

+++++++/*You+can+get+the+user's+claims...+
++++++++++ALSO,+note+that+if+you+have+a+way+to+priorly+map+users+or+users+with+certain+claims+
++++++++++to+particular+policies,+add+those+policies+as+claims+of+the+user+for+the+sake+of+ease.+
++++++++++BUT+policies+that+require+dynamic+code+(e.g.+checking+for+age+range)+would+have+to+be+
++++++++++coded+in+the+switch-case+below+to+determine+stuff.
+++++++*/

++++++++var+claims+=+context.User.Claims;

++++++++//+You+can,+of+course,+get+the+policy+that+was+hit...
++++++++var+policy+=+requirement.Policy

++++++++//You+can+use+a+switch+case+to+determine+what+policy+to+deal+with+here...
++++++++switch+(policy)
++++++++{
++++++++++++case+Enumerations.Security.Policy.CanReadResource:
+++++++++++++++++/*Do+stuff+with+the+claims+and+change+the+
+++++++++++++++++++++value+of+shouldSucceed+and/or+shouldFail.
++++++++++++++++*/
+++++++++++++++++break;
++++++++++++case+Enumerations.Security.Policy.AnotherPolicy:
+++++++++++++++++/*Do+stuff+with+the+claims+and+change+the+
++++++++++++++++++++value+of+shouldSucceed+and/or+shouldFail.
+++++++++++++++++*/
+++++++++++++++++break;
++++++++++++++++//+Other+policies+too.

++++++++++++default:
+++++++++++++++++throw+new+NotImplementedException();
++++++++}

++++++++/*+Note+that+the+following+conditions+are+
++++++++++++so+because+failure+and+success+in+a+requirement+handler+
++++++++++++are+not+mutually+exclusive.+They+demand+certainty.
++++++++*/

++++++++if+(shouldFail)
++++++++{
++++++++++++context.Fail();+/*Check+the+docs+on+this+method+to+
++++++++++++see+its+implications.
++++++++++++*/
++++++++}++++++++++++++++

++++++++if+(shouldSucceed)
++++++++{
++++++++++++context.Succeed(requirement);+
++++++++}+
+++++}
}|6cph3|请注意，上面的代码还可以将用户预先映射到数据存储中的策略。因此，在为用户编写声明时，您基本上可以直接或间接地检索预先映射到用户的策略(例如，因为用户具有某个声明值，并且声明值已被标识并映射到策略，以便它也为具有该声明值的用户提供自动映射)，并将策略登记为声明，这样在授权处理程序中，您可以简单地检查用户的声明是否包含requirement.Policy作为其声明中的声明项的值。这是为了满足策略需求的静态方式，例如“名字”需求在本质上是非常静态的。因此，对于上面的示例(我在对此答案的早期更新中忘记提供有关Authorize属性的示例)，将策略与Authorize属性一起使用如下所示，其中ViewRecord是一个枚举成员：|6lmu4|[Authorize(Policy+=+nameof(Enumerations.Security.Policy.ViewRecord))]|e2urb|动态需求可以是关于检查年龄范围等，并且使用这些需求的策略不能预先映射到用户。|704gt|动态策略声明检查(例如，检查用户是否超过18岁)的一个示例已经在@blowdart+(|daobv|https://stackoverflow.com/a/31465227/4974715|9ga6o|)。|biaa9|附言:我在手机上打了这个。请原谅任何打字错误和缺少格式。^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|19|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|1A|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|1B|9|@]|A|@]|B|$]]|$2|G|4|H|6|I|8|1C|9|@]|A|@]|B|$J|K]]|$2|L|4|M|6|7|8|1D|9|@]|A|@]|B|$]]|$2|N|4|O|6|7|8|1E|9|@]|A|@]|B|$]]|$2|P|4|Q|6|I|8|1F|9|@]|A|@]|B|$J|K]]|$2|R|4|S|6|7|8|1G|9|@]|A|@]|B|$]]|$2|T|4|U|6|I|8|1H|9|@]|A|@]|B|$J|K]]|$2|V|4|W|6|7|8|1I|9|@]|A|@]|B|$]]|$2|X|4|Y|6|I|8|1J|9|@]|A|@]|B|$J|K]]|$2|Z|4|10|6|7|8|1K|9|@]|A|@]|B|$]]|$2|11|4|12|6|7|8|1L|9|@]|A|@]|B|$]]|$2|13|4|14|6|7|8|1M|9|@]|A|@]|B|$]]|$2|15|4|16|6|7|8|1N|9|@]|A|@]|B|$]]|$2|17|4|18|6|7|8|1O|9|@]|A|@]|B|$]]]]

The accepted answer (<a href="https://stackoverflow.com/a/41348219/4974715">https://stackoverflow.com/a/41348219/4974715</a>) is not realistically maintainable or suitable because "CanReadResource" is being used as a claim (but should essentially be a policy in reality, IMO). The approach at the answer is not OK in the way it was used, because if an action method requires many different claims setups, then with that answer you would have to repeatedly write something like... 

<pre><code>[ClaimRequirement(MyClaimTypes.Permission, "CanReadResource")] 
[ClaimRequirement(MyClaimTypes.AnotherPermision, "AnotherClaimVaue")]
//and etc. on a single action.
</code></pre>

So, imagine how much coding that would take. Ideally, "CanReadResource" is supposed to be a policy that uses many claims to determine if a user can read a resource.

What I do is I create my policies as an enumeration and then loop through and set up the requirements like thus...

<pre><code>services.AddAuthorization(authorizationOptions =&gt;
 {
 foreach (var policyString in Enum.GetNames(typeof(Enumerations.Security.Policy)))
 {
 authorizationOptions.AddPolicy(
 policyString,
 authorizationPolicyBuilder =&gt; authorizationPolicyBuilder.Requirements.Add(new DefaultAuthorizationRequirement((Enumerations.Security.Policy)Enum.Parse(typeof(Enumerations.Security.Policy), policyWrtString), DateTime.UtcNow)));

 /* Note that thisn does not stop you from 
 configuring policies directly against a username, claims, roles, etc. You can do the usual.
 */
 }
 }); 
</code></pre>

The DefaultAuthorizationRequirement class looks like...

<pre><code>public class DefaultAuthorizationRequirement : IAuthorizationRequirement
{
 public Enumerations.Security.Policy Policy {get; set;} //This is a mere enumeration whose code is not shown.
 public DateTime DateTimeOfSetup {get; set;} //Just in case you have to know when the app started up. And you may want to log out a user if their profile was modified after this date-time, etc.
}

public class DefaultAuthorizationHandler : AuthorizationHandler&lt;DefaultAuthorizationRequirement&gt;
{
 private IAServiceToUse _aServiceToUse;

 public DefaultAuthorizationHandler(
 IAServiceToUse aServiceToUse
 )
 {
 _aServiceToUse = aServiceToUse;
 }

 protected async override Task HandleRequirementAsync(AuthorizationHandlerContext context, DefaultAuthorizationRequirement requirement)
 {
 /*Here, you can quickly check a data source or Web API or etc. 
 to know the latest date-time of the user's profile modification...
 */
 if (_aServiceToUse.GetDateTimeOfLatestUserProfileModication &gt; requirement.DateTimeOfSetup)
 {
 context.Fail(); /*Because any modifications to user information, 
 e.g. if the user used another browser or if by Admin modification, 
 the claims of the user in this session cannot be guaranteed to be reliable.
 */
 return;
 }

 bool shouldSucceed = false; //This should first be false, because context.Succeed(...) has to only be called if the requirement specifically succeeds.

 bool shouldFail = false; /*This should first be false, because context.Fail() 
 doesn't have to be called if there's no security breach.
 */

 // You can do anything.
 await doAnythingAsync();

 /*You can get the user's claims... 
 ALSO, note that if you have a way to priorly map users or users with certain claims 
 to particular policies, add those policies as claims of the user for the sake of ease. 
 BUT policies that require dynamic code (e.g. checking for age range) would have to be 
 coded in the switch-case below to determine stuff.
 */

 var claims = context.User.Claims;

 // You can, of course, get the policy that was hit...
 var policy = requirement.Policy

 //You can use a switch case to determine what policy to deal with here...
 switch (policy)
 {
 case Enumerations.Security.Policy.CanReadResource:
 /*Do stuff with the claims and change the 
 value of shouldSucceed and/or shouldFail.
 */
 break;
 case Enumerations.Security.Policy.AnotherPolicy:
 /*Do stuff with the claims and change the 
 value of shouldSucceed and/or shouldFail.
 */
 break;
 // Other policies too.

 default:
 throw new NotImplementedException();
 }

 /* Note that the following conditions are 
 so because failure and success in a requirement handler 
 are not mutually exclusive. They demand certainty.
 */

 if (shouldFail)
 {
 context.Fail(); /*Check the docs on this method to 
 see its implications.
 */
 } 

 if (shouldSucceed)
 {
 context.Succeed(requirement); 
 } 
 }
}
</code></pre>

Note that the code above can also enable pre-mapping of a user to a policy in your data store. So, when composing claims for the user, you basically retrieve the policies that had been pre-mapped to the user directly or indirectly (e.g. because the user has a certain claim value and that claim value had been identified and mapped to a policy, such that it provides automatic mapping for users who have that claim value too), and enlist the policies as claims, such that in the authorization handler, you can simply check if the user's claims contain requirement.Policy as a Value of a Claim item in their claims. That is for a static way of satisfying a policy requirement, e.g. "First name" requirement is quite static in nature. So, for the example above (which I had forgotten to give example on Authorize attribute in my earlier updates to this answer), using the policy with Authorize attribute is like as follows, where ViewRecord is an enum member:

<pre><code>[Authorize(Policy = nameof(Enumerations.Security.Policy.ViewRecord))] 
</code></pre>

A dynamic requirement can be about checking age range, etc. and policies that use such requirements cannot be pre-mapped to users.

An example of dynamic policy claims checking (e.g. to check if a user is above 18 years old) is already at the answer given by @blowdart (<a href="https://stackoverflow.com/a/31465227/4974715">https://stackoverflow.com/a/31465227/4974715</a>).

PS: I typed this on my phone. Pardon any typos and lack of formatting.

entityMap|blocks|key|8m10d|text|只是添加了@Shawn的很好的答案。如果您使用的是dotnet+5，则需要将类更新为：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|7s5g6|public+abstract+class+AttributeAuthorizationHandler+:+AuthorizationHandler+where+TRequirement+:+IAuthorizationRequirement+where+TAttribute+:+Attribute
{
++++protected+override+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+TRequirement+requirement)
++++{
++++++++var+attributes+=+new+List();
++++++++
++++++++if+(context.Resource+is+HttpContext+httpContext)
++++++++{
++++++++++++var+endPoint+=+httpContext.GetEndpoint();

++++++++++++var+action+=+endPoint?.Metadata.GetMetadata();

++++++++++++if(action+!=+null)
++++++++++++{
++++++++++++++++attributes.AddRange(GetAttributes(action.ControllerTypeInfo.UnderlyingSystemType));
++++++++++++++++attributes.AddRange(GetAttributes(action.MethodInfo));
++++++++++++}
++++++++}
++++++++
++++++++return+HandleRequirementAsync(context,+requirement,+attributes);
++++}

++++protected+abstract+Task+HandleRequirementAsync(AuthorizationHandlerContext+context,+TRequirement+requirement,+IEnumerable+attributes);

++++private+static+IEnumerable+GetAttributes(MemberInfo+memberInfo)+=>+memberInfo.GetCustomAttributes(typeof(TAttribute),+false).Cast();
}|code-block|syntax|javascript|dhsqq|注意到获取ControllerActionDescriptor的方式已经改变了。^0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|J|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|K|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|L|9|@]|A|@]|B|$]]]]

Just adding to the great answer from @Shawn. If you are using dotnet 5 you need to update the class to be:
<pre><code>public abstract class AttributeAuthorizationHandler&lt;TRequirement, TAttribute&gt; : AuthorizationHandler&lt;TRequirement&gt; where TRequirement : IAuthorizationRequirement where TAttribute : Attribute
{
 protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement)
 {
 var attributes = new List&lt;TAttribute&gt;();
 
 if (context.Resource is HttpContext httpContext)
 {
 var endPoint = httpContext.GetEndpoint();

 var action = endPoint?.Metadata.GetMetadata&lt;ControllerActionDescriptor&gt;();

 if(action != null)
 {
 attributes.AddRange(GetAttributes(action.ControllerTypeInfo.UnderlyingSystemType));
 attributes.AddRange(GetAttributes(action.MethodInfo));
 }
 }
 
 return HandleRequirementAsync(context, requirement, attributes);
 }

 protected abstract Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement, IEnumerable&lt;TAttribute&gt; attributes);

 private static IEnumerable&lt;TAttribute&gt; GetAttributes(MemberInfo memberInfo) =&gt; memberInfo.GetCustomAttributes(typeof(TAttribute), false).Cast&lt;TAttribute&gt;();
}
</code></pre>
Noting the way getting the ControllerActionDescriptor has changed.

entityMap|blocks|key|cfgk|text|我有不记名令牌，我可以阅读声明。我在控制器和操作上使用该属性|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4i5ej|public+class+CustomAuthorizationAttribute+:+ActionFilterAttribute
{
++++public+string[]+Claims;

++++public+override+void+OnActionExecuting(ActionExecutingContext+context)
++++{
++++++++//+check+user+
++++++++var+contextUser+=+context?.HttpContext?.User;
++++++++if+(contextUser+==+null)
++++++++{
++++++++++++throw+new+BusinessException("Forbidden");
++++++++}


++++++++//+check+roles
++++++++var+roles+=+contextUser.FindAll("http://schemas.microsoft.com/ws/2008/06/identity/claims/role").Select(c+=>+c.Value).ToList();
++++++++if+(!roles.Any(s+=>+Claims.Contains(s)))
++++++++{
++++++++++++throw+new+BusinessException("Forbidden");
++++++++}

++++++++base.OnActionExecuting(context);
++++}
}|code-block|syntax|javascript|2upnd|示例|5mk18|[CustomAuthorization(Claims+=+new+string[]
++++{
++++++++nameof(AuthorizationRole.HR_ADMIN),
++++++++nameof(AuthorizationRole.HR_SETTING)
++++})]
[Route("api/[controller]")]
[ApiController]
public+class+SomeAdminController+:+ControllerBase
{
++++private+readonly+IMediator+_mediator;

++++public+SomeAdminController(IMediator+mediator)
++++{
++++++++_mediator+=+mediator;
++++}

++++[HttpGet("list/SomeList")]
++++public+async+Task+SomeList()
++++++++=>+Ok(await+_mediator.Send(new+SomeListQuery()));
}|d50n3|这就是角色|3gl73|public+struct+AuthorizationRole
{
++++public+static+string+HR_ADMIN;
++++public+static+string+HR_SETTING;
}^0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|P|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|Q|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|R|9|@]|A|@]|B|$]]|$2|J|4|K|6|E|8|S|9|@]|A|@]|B|$F|G]]|$2|L|4|M|6|7|8|T|9|@]|A|@]|B|$]]|$2|N|4|O|6|E|8|U|9|@]|A|@]|B|$F|G]]]]

I have bearer token and I can read claims.
I use that attribute on controllers and actions
<pre><code>public class CustomAuthorizationAttribute : ActionFilterAttribute
{
 public string[] Claims;

 public override void OnActionExecuting(ActionExecutingContext context)
 {
 // check user 
 var contextUser = context?.HttpContext?.User;
 if (contextUser == null)
 {
 throw new BusinessException(&quot;Forbidden&quot;);
 }


 // check roles
 var roles = contextUser.FindAll(&quot;http://schemas.microsoft.com/ws/2008/06/identity/claims/role&quot;).Select(c =&gt; c.Value).ToList();
 if (!roles.Any(s =&gt; Claims.Contains(s)))
 {
 throw new BusinessException(&quot;Forbidden&quot;);
 }

 base.OnActionExecuting(context);
 }
}
</code></pre>
example
<pre><code>[CustomAuthorization(Claims = new string[]
 {
 nameof(AuthorizationRole.HR_ADMIN),
 nameof(AuthorizationRole.HR_SETTING)
 })]
[Route(&quot;api/[controller]&quot;)]
[ApiController]
public class SomeAdminController : ControllerBase
{
 private readonly IMediator _mediator;

 public SomeAdminController(IMediator mediator)
 {
 _mediator = mediator;
 }

 [HttpGet(&quot;list/SomeList&quot;)]
 public async Task&lt;IActionResult&gt; SomeList()
 =&gt; Ok(await _mediator.Send(new SomeListQuery()));
}
</code></pre>
That is Roles
<pre><code>public struct AuthorizationRole
{
 public static string HR_ADMIN;
 public static string HR_SETTING;
}
</code></pre>

I'm trying to make a custom authorization attribute in ASP.NET Core. In previous versions it was possible to override <code>bool AuthorizeCore(HttpContextBase httpContext)</code>. But this no longer exists in <a href="https://github.com/aspnet/Security/blob/3a8ea672eae590785a78d74777abb76bb9664130/src/Microsoft.AspNet.Authorization/AuthorizeAttribute.cs"><code>AuthorizeAttribute</code></a>.

What is the current approach to make a custom AuthorizeAttribute?

What I am trying to accomplish: I am receiving a session ID in the Header Authorization. From that ID I'll know whether a particular action is valid.

How do you create a custom AuthorizeAttribute in ASP.NET Core?

 我正在尝试在ASP.NET核心中创建一个自定义的授权属性。在以前的版本中，可以覆盖 ..。但这不再存在于 ..。 目前定制AuthorizeAttribute的方法是什么？ 我想要完成的事情:我在Authorization头中收到一个会话ID。通过这个ID，我可以知道某个特定的操作是否有效。

问如何在ASP.NET核心中创建自定义AuthorizeAttribute？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在ASP.NET核心中创建自定义AuthorizeAttribute？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在ASP.NET核心中创建自定义AuthorizeAttribute？
EN