c# - 如何在 ASP.NET CORE 中为多个策略创建自定义授权属性

Question

我想授权一个 Action Controller 可以通过多个策略访问。

。例如:

[Authorize([Policies.ManageAllCalculationPolicy,Policies.ManageAllPriceListPolicy]]
public async Task<IActionResult> Get(int id){}

非常感谢。

Answer 1

对于多个策略，您可以实现自己的 AuthorizeAttribute。

AuthorizeMultiplePolicyAttribute

 public class AuthorizeMultiplePolicyAttribute:TypeFilterAttribute
 {
 public AuthorizeMultiplePolicyAttribute(string policies,bool IsAll):base(typeof(AuthorizeMultiplePolicyFilter))
 {
     Arguments = new object[] { policies,IsAll};
 }
 }

授权多重策略过滤器

 public class AuthorizeMultiplePolicyFilter: IAsyncAuthorizationFilter
 {
 private readonly IAuthorizationService _authorization;
 public string _policies { get; private set; }
 public bool _isAll { get; set; }
 public AuthorizeMultiplePolicyFilter(string policies, bool IsAll,IAuthorizationService authorization)
 {
     _policies = policies;
     _authorization = authorization;
     _isAll = IsAll;
 }

 public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
 {

     var policys = _policies.Split(";").ToList();
     if (_isAll)
     {
         foreach (var policy in policys)
         {
             var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
             if (!authorized.Succeeded)
             {
                 context.Result = new ForbidResult();
                 return;
             }
         }
     }
     else
     {
         foreach (var policy in policys)
         {
             var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
             if (authorized.Succeeded)
             {
                 return;
             }
         }
         context.Result = new ForbidResult();
         return;
     }
 }
 }

在启动时添加您想要的策略

 services.AddAuthorization(options =>
     {

         options.AddPolicy("ManageAllCalculationPolicy", policy =>
                 policy.RequireAssertion(context =>
                     context.User.HasClaim(c => c.Type == "BadgeId")));

         options.AddPolicy("ManageAllPriceListPolicy", policy =>
                 policy.RequireAssertion(context =>
                     context.User.HasClaim(c => c.Type == "aaaa")));
     });

基于其中一项政策的授权

 [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", false)]

基于所有策略的授权

 [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", true)]