c# - asp.net core authorization - 操作授权处理程序

Question

我有一个奇怪的问题，无法调试。

我正在尝试使用 OperationAuthorizationRequirement 和一个 AuthorizationHandler。

当我在 Controller 中放置断点时，我总是得到 403 结果，因此我尝试在 CountryControllerAuthorizationHandler 中放置断点，但它从未被触发。但是在 Controller 中，我总是得到 AuthorizeAsync false 的结果，但我不明白为什么我无法命中或触发断点。我在犯一些愚蠢的错误吗？无论如何，正如我所见，资源是 NOT null 并且 User 和 claims 也是 NOT null:

这是我的代码:

国家 Controller 授权处理程序:

public class CountryControllerAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Country>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                   OperationAuthorizationRequirement requirement,
                                                   Country resource)
    {
        if (requirement.Name == Operations.ReadDetail.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "customer"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Create.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Update.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Delete.Name &&
           context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
           )
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

操作类:

public static class Operations
{
    public static OperationAuthorizationRequirement Create =
        new OperationAuthorizationRequirement { Name = nameof(Create) };
    public static OperationAuthorizationRequirement Read =
        new OperationAuthorizationRequirement { Name = nameof(Read) };
    public static OperationAuthorizationRequirement ReadDetail =
      new OperationAuthorizationRequirement { Name = nameof(ReadDetail) };
    public static OperationAuthorizationRequirement Update =
        new OperationAuthorizationRequirement { Name = nameof(Update) };
    public static OperationAuthorizationRequirement Delete =
        new OperationAuthorizationRequirement { Name = nameof(Delete) };
}

启动.cs:

services.AddSingleton<IAuthorizationHandler, CountryControllerAuthorizationHandler>();

services.AddMvcCore()
    .AddAuthorization()
    .AddJsonFormatters();

services.AddAuthentication("Bearer")
    .AddIdentityServerAuthentication(options =>
    {
        options.Authority = "http://localhost:5000";
        options.RequireHttpsMetadata = false;
        options.ApiName = "api1";
    });

最后是 Controller :

public CountriesController(ICountryService service, IAuthorizationService authorizationService)
{
    _authorizationService = authorizationService;
    this.countryService = service;
}

public async Task<object> GetDetail()
{
    var obj = countryService.Get_DETAILS();
    var authorizationResult = await _authorizationService.AuthorizeAsync(User, obj, Operations.ReadDetail);

    if (authorizationResult.Succeeded)
    {
        return Ok(obj);
    }
    else if (User.Identity.IsAuthenticated)
    {
        return new ForbidResult();
    }
    else
    {
        return new ChallengeResult();
    }
}

Answer 1

确保 countryService.Get_DETAILS() 不为空并且只返回一个国家。

对于CountryControllerAuthorizationHandler，它接受Country，因此，只有一个县对象被传递到HandleRequirementAsync。

HandleRequirementAsync 由 AuthorizationHandler 中的 HandleAsync 调用。

尝试使用以下代码进行测试以调试未调用 HandleRequirementAsync 的原因。

    public class CountryControllerAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Country>
{
    public override async Task HandleAsync(AuthorizationHandlerContext context)
    {
        if (context.Resource is Country)
        {
            foreach (var req in context.Requirements.OfType<OperationAuthorizationRequirement>())
            {
                await HandleRequirementAsync(context, req, (Country)context.Resource);
            }
        }
    }
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                   OperationAuthorizationRequirement requirement,
                                                   Country resource)
    {
        if (requirement.Name == Operations.ReadDetail.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "customer"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Create.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Update.Name &&
            context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
            )
        {
            context.Succeed(requirement);
        }

        if (requirement.Name == Operations.Delete.Name &&
           context.User.Claims.FirstOrDefault(a => a.Type == "userType")?.Value == "1"
           )
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}