azure - 在 API 管理策略中，检查 header 值是否在列表/数组内

Question

我有一个 API 管理入站策略，可以从 JWT 中获取用户 ID。为了进行某些测试，我希望 API 管理检查策略，“此 ID 是否在允许访问此处的测试人员 ID 列表中”

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
            <openid-config url="myurl" />
        </validate-jwt>
        <set-header name="header-value-userId" exists-action="override">
            <value>@(context.Request.Headers.GetValueOrDefault("Authorization").AsJwt()?.Claims.GetValueOrDefault("oid"))</value>
        </set-header>
        <!--
        PSEUDOCDOE below to describe my intention
        How can I check that the abover header-value-userId value is within a hardcoded list at this point?
        
        @{
            string[] userList = ["user1", "user2", "user3"];

            var match = userList.FirstOrDefault(x => x.Contains(header-value-userId));

            if(match == null)
                return bad request
        }
        -->
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

感谢您的帮助。

--- 更新 ---

感谢 Markus Meyer 的回答，我现在可以正常工作了。请参阅下面我现在完整的工作示例。

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
            <openid-config url="myurl" />
        </validate-jwt>
        <set-variable name="isValidUser" value="@{

            var email = context.Request.Headers.GetValueOrDefault("Authorization").AsJwt()?.Claims.GetValueOrDefault("emails");

            string[] emailList = new string[] { "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="8feae2eee6e3becfe8e2eee6e3a1ece0e2" rel="noreferrer noopener nofollow">[email protected]</a>", "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="06636b676f6a3446616b676f6a2865696b" rel="noreferrer noopener nofollow">[email protected]</a>" };

            var match = emailList.Any(x => x.Contains(email));

            if(match == true)
            {
                return true;
            }
            
            return false;
        }" />
        <choose>
            <when condition="@(context.Variables.GetValueOrDefault<bool>("isValidUser") == false)">
                <return-response>
                    <set-status code="401" reason="Unauthorized" />
                    <set-header name="Content-Type" exists-action="override">
                        <value>application/json</value>
                    </set-header>
                    <set-body>@("{\"status\": \"" + "User not valid" + "\"}")</set-body>
                </return-response>
            </when>
            <otherwise>
                <return-response>
                    <set-status code="200" reason="Valid" />
                    <set-header name="Content-Type" exists-action="override">
                        <value>application/json</value>
                    </set-header>
                    <set-body>@("{\"status\": \"" + "User valid" + "\"}")</set-body>
                </return-response>
            </otherwise>
        </choose>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Answer 1

使用choose策略允许您检查 bool 条件。
在当前示例中，条件设置在 set-variable 中。政策

return-response将返回您想要的回复。

完整示例:

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
            <openid-config url="myurl" />
        </validate-jwt>
        <set-header name="header-value-userId" exists-action="override">
            <value>@(context.Request.Headers.GetValueOrDefault("Authorization").AsJwt()?.Claims.GetValueOrDefault("oid"))</value>
        </set-header>
        <set-variable name="isValidUser" value="@{
            string[] userList = new string[] { "user1", "user2", "user3" };
            var match = userList.FirstOrDefault(x => x.Contains("header-value-userId"));
            if(match == null)
            {
                return true;
            }
            
            return false;
        }" />
        <choose>
            <when condition="@(context.Variables.GetValueOrDefault<bool>("isValidUser") == false)">
                <return-response>
                    <set-status code="401" reason="Unauthorized" />
                    <set-header name="Content-Type" exists-action="override">
                        <value>application/json</value>
                    </set-header>
                    <set-body>@("{\"status\": \"" + "User not valid" + "\"}")</set-body>
                </return-response>
            </when>
        </choose> 
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

需要注意的几点:

这是string[]的正确代码:

string[] userList = new string[] { "user1", "user2", "user3" };

无需将 usereId 存储到 header 中。该值也可以存储在变量中。