Question

我正在创建策略库授权，并希望允许一个策略中的多个用户访问网页。

我在启动文件中创建了如下所示的策略。问题，如何在一个策略中使用多个用户名？我查看了.RequireUserName的方法，它只接受字符串用户名。

政策名称AdminServiceAccount主要是我感兴趣添加多个用户。如果我使用param .RequireUserName("DOMAIN\\USER1,DOMAIN\\USER2")它会起作用吗？我不这么认为，但想检查是否有另一种方式。

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("Admin", policy => policy.RequireRole("Domain\\GroupName"));
                    option.AddPolicy("SuperAdminUser", policy => policy.RequireUserName("DOMAIN\\SuperAdminUser"));
                    option.AddPolicy("AdminServiceAccount", policy => policy.RequireUserName("DOMAIN\\USER1"));
                }
        );

更新1：

更新2：

所以在我的控制器中，我添加了[Authorize(Policy = "UserNamesPolicy")]，如下所示：

[Authorize(Policy = "UserNamesPolicy")]
public class ServersController : Controller
{
    private readonly ServerMatrixDbContext _context;

    public ServersController(ServerMatrixDbContext context)
    {
        _context = context;    
    }

    // GET: Servers
    public async Task<IActionResult> Index()
    {
        // Some code here
        return View();
    }
}

这是我的启动文件：

services.AddAuthorization(
                option =>
                {
                    option.AddPolicy("UserNamesPolicy",
                                          policy => policy.Requirements.Add(new UserNamesRequirement("DOMAIN\\USER1", "DOMAIN\\USER2"))
                    );
                }
        );
services.AddSingleton<IAuthorizationHandler, UserNamesRequirement();

对于启动文件中的.AddSingleTon，我得到以下错误：

以下是handler类：

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

以下是UserNamesRequirement类：

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] UserNames)
    {
        Users = UserNames;
    }
    public string[] Users { get; set; }
}

更新3：已解决!!!!

以下是从更新2 添加的一些更改：

在UserNameshandler类中更改了var userName以从context.User.Identity.Name;

获取值

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        // var userName = context.User.FindFirst(ClaimTypes.NameIdentifier).Value;
        var userName = context.User.Identity.Name;

        if (requirement.Users.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

在StartUp类中，从services.AddSingleton<IAuthorizationHandler, UserNamesRequirement>();修复为services.AddSingleton<IAuthorizationHandler,UserNamesHandler>();

感谢Gevory。：）

Answer 1

public class UserNamesHandler : AuthorizationHandler<UserNamesRequirement>
{

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserNamesRequirement requirement)
    {
        var userName = context.User.Identity.Name;

        if(requirement.UserNames.ToList().Contains(userName))
            context.Succeed(requirement);
        return Task.CompletedTask; // if it does not compile use Task.FromResult(0)
    }
}

public class UserNamesRequirement : IAuthorizationRequirement
{
    public UserNamesRequirement(params string[] UserNames)
    {
        UserNames = UserNames;
    }

    public string[] UserNames { get; set; }
}

在startup.cs中添加

public void ConfigureServices(IServiceCollection services)
{
            services.AddAuthorization(options =>
            {
                options.AddPolicy("UserNamesPolicy",
                                  policy => policy.Requirements.Add(new UserNamesRequirement("ggg","dsds")));
            });
           services.AddSingleton<IAuthorizationHandler, UserNamesHandler>()

}

ASP.NET核心策略库使用RequireUser使用字符串数组

1 个答案: