c# - .NET Core 2.1 - 未达到 AuthorizationHandler 并始终返回 401

Question

我已经实现了自定义授权处理程序来确定用户是否有权编辑或删除资源。
但是处理程序从未被调用，当我尝试编辑资源时，我总是得到 401 状态代码。

这是我的自定义处理程序:

public class MeetingAuthorizationHandler : AuthorizationHandler<SameCreatorRequirement, Meeting>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, SameCreatorRequirement requirement, Meeting resource)
    {
        /*if (context.User.Claims.Where(c => c.Type == ClaimTypes.NameIdentifier).FirstOrDefault() != null)
        {
            int idCreator = Int32.Parse(context.User.Claims.Where(c => c.Type == ClaimTypes.NameIdentifier).FirstOrDefault().Value);
            if(idCreator == resource.CreatedBy.IdUserPreferences)
            {
                context.Succeed(requirement);
            }
        }*/

        context.Succeed(requirement);

        return Task.CompletedTask;
    }
}

public class SameCreatorRequirement : IAuthorizationRequirement
{
}

我还在配置方法中添加了这些行:

services.AddSingleton<IAuthorizationHandler, MeetingAuthorizationHandler>();
services.AddAuthorization(options =>
{
    options.AddPolicy("Admin", policy => policy.RequireClaim("Admin"));
    options.AddPolicy("EditPolicy", policy => policy.Requirements.Add(new SameCreatorRequirement()));
});

在 Controller 中，我使用这个:

[Route("Meetings/Edit/{id}")]
[Authorize(Policy = "EditPolicy")]
public async Task<IActionResult> Edit(int id)

我已经阅读了很多相关的帖子，并且找到了它不起作用的原因。这段代码有什么问题？

编辑1

我在输出中找到了这个(我使用没有身份的 Cookie 身份验证，请参阅 this)

    Microsoft.AspNetCore.Authorization.DefaultAuthorizationService:Information: Authorization was successful.
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService:Information: Authorization failed.
Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
Microsoft.AspNetCore.Mvc.ForbidResult:Information: Executing ForbidResult with authentication schemes ().
Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler:Information: AuthenticationScheme: Cookies was forbidden.
Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Executed action RoomScheduling.Controllers.MeetingsController.Edit (RoomScheduling) in 21.4851ms

编辑2

这是我的 Controller :

namespace RoomScheduling.Controllers
{
    [Authorize]
    public class MeetingsController : Controller
    {

       /** ------------------- **/

        [Route("Meetings/Edit/{id}")]
        [Authorize(Policy = "EditPolicy")]
        public async Task<IActionResult> Edit(int id)
        {
            MeetingView meetingView = new MeetingView();

            Meeting meeting = await _context.Meeting
                .Include(m => m.Room)
                .Include(m => m.MeetingType)
                .Include(m => m.CreatedBy)
                //.Include(m => m.UpdatedBy)
                .Include(m => m.Attendees)
                .AsNoTracking()
                .SingleAsync(m => m.IdMeeting == id);

            meeting.UpdatedBy = new UserPreferences();
            meeting.UpdatedBy.IdUserPreferences = GetCurrentUserId();
            meetingView.Meeting = meeting;
            meetingView.Attendees = meeting.Attendees.Select(c => c.Attendant).ToArray();

            ViewBag.RoomId = new SelectList(_context.Room.AsNoTracking().Include(m => m.Area).ToList(), "IdRoom", "Name", meeting.Room.IdRoom, "Area.Name"); //Dropdown list
            ViewBag.MeetingTypeId = new SelectList(_context.MeetingType.AsNoTracking().ToList(), "IdMeetingType", "Name"); //Dropdown list
            ViewBag.AttendeesIdList = new MultiSelectList(_context.Attendees.AsNoTracking().Select(a => a.Attendant).Distinct().ToList(), "", "", meetingView.Attendees);

            return View(meetingView);
        }

       /** ------------------- **/
    }
}

Answer 1

问题是您正在尝试对资源进行授权。您的保单不知道如何检索或访问 Meeting资源。

如果您想在 AuthorizationHandler 中做出决定需要访问 Meeting您可以注入(inject) IAuthorizationService 的对象进入您的 Controller 并使用您的 Meeting 调用针对该策略的授权资源。

[Route("Meetings/Edit/{id}")]
[Authorize(Policy = "EditPolicy")]
public async Task<IActionResult> Edit(int id)
{
    MeetingView meetingView = new MeetingView();

    Meeting meeting = await _context.Meeting
        .Include(m => m.Room)
        .Include(m => m.MeetingType)
        .Include(m => m.CreatedBy)
        //.Include(m => m.UpdatedBy)
        .Include(m => m.Attendees)
        .AsNoTracking()
        .SingleAsync(m => m.IdMeeting == id);

    // Authorize the user against the EditPolicy using the meeting resource.
    var result = await _authorizationService.AuthorizeAsync(User, meeting, "EditPolicy");
    if (!result.Succeeded)
    {
        return Forbid();
    }
    // Do stuff.
}

如果您不想对资源做出授权决定，您可以使用不同的 AuthorizationHandler<TRequirement>例如:

public class MeetingAuthorizationHandler : AuthorizationHandler<SameCreatorRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, SameCreatorRequirement requirement)
    {
        context.Succeed(requirement);
        return Task.CompletedTask;
    }
}