asp.net mvc 和 azure 基于活动目录安全组的授权 [英] asp.net mvc and azure active directory security group based authorization

问题描述

我正在寻找 ASP.NET MVC 应用程序的帮助.它对单租户 Azure Active Directory 用户进行身份验证，并可以使用 Active Directory 安全组授权用户.即，如果用户是该安全组的一部分，则只允许访问网站，否则访问被拒绝.

Visual Studio 本身可以使用向导完成 Active Directory 身份验证，但不确定如何通过 AAD 安全组执行授权.

附:我是 ASP.NET 安全新手

解决方案

当用户登录应用程序时，来自 Azure AD 的传入令牌将包含 组声明，一旦你适当地修改了应用程序的清单 (有关步骤，请参阅下面的示例应用程序链接).然后，您的应用程序代码可以读取这些声明并根据它们做出授权决策.

这是一个基于组声明进行授权的示例应用程序 -

实施授权逻辑时要考虑的其他信息

1. 您已经特别询问了有关组的问题，但您还应该考虑使用应用程序角色，它可以帮助您实现基于角色的授权逻辑.查看 Microsoft 文档链接

   I am looking help for ASP.NET MVC application. Which authenticate single tenant azure active directory users and can authorize users using active directory security group. i.e. if user is part of that security group then only allow access to website otherwise access denied.

   Active directory authentication can be done by visual studio itself using wizard but not sure how to perform authorization through AAD security group.

   P.S. I am new to ASP.NET security

   解决方案

   When a user signs into the application, incoming token from Azure AD will contain group claims, once you modify the application's manifest appropriately (see the sample application link below for steps). Your application code can then read these claims and make authorization decisions based on them.

   Here is a sample application that does authorization based on group claims -

   Authorization in a web app using Azure AD groups & group claims

   Group claims

   ADDITIONAL INFORMATION TO CONSIDER WHEN IMPLEMENTING AUTHORIZATION LOGIC

   1. You have specifically asked about Groups, but you should also consider using Application Roles, which can help you implement a Role based authorization logic. Look at Microsoft documentation link Application Roles. Here is a link to another similar question where I have provided a little more detailed information on both Application Roles and Groups and links to sample code for both. Azure Active Directory Integration with Custom RBAC

      Once you understand the usage/purpose of application roles and groups, it's completely possible for you to decide that you want to base your authorization logic on a combination of Roles and Groups information for the signed in user instead of just one.

   2. In case when a user is part of many groups (6 or more AFAIK), Azure AD token doesn't send across the "groups" directly as part of token, instead it sends an overage indicator and then you can query the groups in a separate call. Take a look at the token related documentation here - Claims in id_tokens

   这篇关于asp.net mvc 和 azure 基于活动目录安全组的授权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！