asp.net-mvc MVC5 声明版本的 Authorize 属性
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19363809/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
MVC5 Claims version of the Authorize attribute
提问by EightyOne Unite
I'm trying out some of the new stuff in VS2013 RC with MVC5 and the new OWIN authentication middleware.
我正在使用 MVC5 和新的 OWIN 身份验证中间件尝试 VS2013 RC 中的一些新东西。
So, I'm used to using the [Authorize]attribute to limit actions by role but I'm trying to use claims/activity based authorization, and I can't find an equivalent attribute for it.
所以，我习惯于使用该[Authorize]属性来限制角色的操作，但我正在尝试使用基于声明/活动的授权，但我找不到它的等效属性。
Is there an obvious one I'm missing or do I need to roll my own? I kinda expected there to be one out of the box.
是否有一个明显的我遗漏了还是我需要自己动手？我有点期待有一个开箱即用的。
What I'm looking for specifically is something along the lines of [Authorize("ClaimType","ClaimValue")]I suppose.
我正在寻找的具体内容与[Authorize("ClaimType","ClaimValue")]我想的差不多。
Thanks in advance.
提前致谢。
采纳答案by EightyOne Unite
I ended up just writing a simple attribute to handle it. I couldn't find anything in the framework right out of the box without a bunch of extra config. Listed below.
我最终只是编写了一个简单的属性来处理它。如果没有一堆额外的配置，我在框架中找不到任何开箱即用的东西。下面列出。
public class ClaimsAuthorizeAttribute : AuthorizeAttribute
{
private string claimType;
private string claimValue;
public ClaimsAuthorizeAttribute(string type, string value)
{
this.claimType = type;
this.claimValue = value;
}
public override void OnAuthorization(AuthorizationContext filterContext)
{
var user = filterContext.HttpContext.User as ClaimsPrincipal;
if (user != null && user.HasClaim(claimType, claimValue))
{
base.OnAuthorization(filterContext);
}
else
{
base.HandleUnauthorizedRequest(filterContext);
}
}
}
Of course, you could remove the type and value params if you were happy to use the controller-action-verb triplet for claims somehow.
当然，如果您乐于以某种方式使用控制器-动作-动词三元组进行声明，您可以删除类型和值参数。
回答by leastprivilege
- You wouldn't check for claims specifically, but rather for action/resource pairs. Factor out the actual claims / data checks into an authorization manager. Separation of concerns.
- MVC and ClaimsPrincipalPermission is not a good match. It throws a SecurityException and is not unit testing friendly.
- 您不会专门检查声明，而是检查操作/资源对。将实际声明/数据检查分解到授权管理器中。关注点分离。
- MVC 和 ClaimsPrincipalPermission 不是很好的匹配。它抛出一个 SecurityException 并且不是单元测试友好的。
My version is here: http://leastprivilege.com/2012/10/26/using-claims-based-authorization-in-mvc-and-web-api/
我的版本在这里：http: //leastprivilege.com/2012/10/26/using-claims-based-authorization-in-mvc-and-web-api/
回答by Softlion
I found that you can still use the Authorization attribute with roles and users, with claims.
For this to work, your ClaimsIdentity have to include 2 specific claim types:
我发现您仍然可以将 Authorization 属性用于角色和用户以及声明。
为此，您的 ClaimsIdentity 必须包含 2 种特定的声明类型：
ClaimTypes.Name
and
和
ClaimTypes.Role
Then in your class derived from OAuthAuthorizationServerProvider, in the GrantXX methods you use, when you create your ClaimsIdentity, add these 2 claims.
然后在从 OAuthAuthorizationServerProvider 派生的类中，在您使用的 GrantXX 方法中，当您创建 ClaimsIdentity 时，添加这 2 个声明。
Example:
例子：
var oAuthIdentity = new ClaimsIdentity(new[]
{
new Claim(ClaimTypes.Name, context.ClientId),
new Claim(ClaimTypes.Role, "Admin"),
}, OAuthDefaults.AuthenticationType);
Then on any action you can use [Authorize(Roles ="Admin")]to restrict access.
然后在您可以[Authorize(Roles ="Admin")]用来限制访问的任何操作上。
回答by Eric J.
In ASP.NET Core 3, you can configure security policies like this:
在 ASP.NET Core 3 中，您可以像这样配置安全策略：
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
services.AddAuthorization(options =>
{
options.AddPolicy("EmployeeOnly", policy => policy.RequireClaim("EmployeeNumber"));
});
}
then use AuthorizeAttribute to require the user meet the requirements of a specific policy (in other words, meet the claim backing that policy).
然后使用 AuthorizeAttribute 要求用户满足特定策略的要求（换句话说，满足支持该策略的声明）。
[Authorize(Policy = "EmployeeOnly")]
public IActionResult VacationBalance()
{
return View();
}
来源。
回答by jd4u
[ClaimsPrincipalPermission(SecurityAction.Demand, Operation="Delete", Resource="Customer")]
public ActionResult Delete(int id)
{
_customer.Delete(id);
return RedirectToAction("CustomerList");
}
