ASP.NET Core 策略库使用 RequireUser 和字符串数组进行授权

Question

我正在创建策略库授权，并希望允许一个策略中的多个用户访问网页。

我在启动文件中创建了如下所示的策略。问题，如何在一个策略中使用多个用户名？我查看了 .RequireUserName 的方法，它只接受字符串用户名。

策略名称 AdminServiceAccount 主要是我有兴趣添加多个用户。如果我使用 param .RequireUserName("DOMAIN\\USER1,DOMAIN\\USER2") 会起作用吗？我不这么认为，但想检查是否有替代方法。

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("Admin", policy => policy.RequireRole("Domain\\GroupName"));
                    option.AddPolicy("SuperAdminUser", policy => policy.RequireUserName("DOMAIN\\SuperAdminUser"));
                    option.AddPolicy("AdminServiceAccount", policy => policy.RequireUserName("DOMAIN\\USER1"));
                }
        );

更新 1:


更新 2:

所以在我的 Controller 中，我添加了 [Authorize(Policy = "UserNamesPolicy")] 如下所示:

[Authorize(Policy = "UserNamesPolicy")]
public class ServersController : Controller
{
    private readonly ServerMatrixDbContext _context;

    public ServersController(ServerMatrixDbContext context)
    {
        _context = context;    
    }

    // GET: Servers
    public async Task<IActionResult> Index()
    {
        // Some code here
        return View();
    }
}

这是我的启动文件:

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("UserNamesPolicy",
                                          policy => policy.Requirements.Add(new UserNamesRequirement("DOMAIN\\USER1", "DOMAIN\\USER2"))
                    );
                }
        );
services.AddSingleton<IAuthorizationHandler, UserNamesRequirement();

对于启动文件中的 .AddSingleTon，我收到以下错误:



这是 handler 类:

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

这是 UserNamesRequirement 类:

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] UserNames)
    {
        Users = UserNames;
    }
    public string[] Users { get; set; }
}

更新 3: 已解决!!!!

以下是从 更新 2 添加的一些更改:

在 UserNameshandler 类中更改了 var userName 以从 context.User.Identity.Name; 获取值

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        // var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;
        var userName = context.User.Identity.Name;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

在 StartUp 类中从 services.AddSingleton<IAuthorizationHandler, UserNamesRequirement>(); 固定为 services.AddSingleton<IAuthorizationHandler,UserNamesHandler>();
感谢 Gevory。 :)

Answer 1

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.Identity.Name;
        if(requirement.UserNames.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.CompletedTask; // if it does not compile use Task.FromResult(0);
    }
}

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] userNames)
    {
        UserNames = userNames;
    }

    public string[] UserNames { get; set; }
}

在 startup.cs 添加以下内容

public void ConfigureServices(IServiceCollection services)
{
            services.AddAuthorization(options =>
            {
                options.AddPolicy("UserNamesPolicy",
                                  policy => policy.Requirements.Add(new UserNamesRequirement("ggg","dsds")));
            });
           services.AddSingleton<IAuthorizationHandler, UserNamesHandler>()

}