与扩展的MVC Core Identity用户实施自定义声明 [英] Implementing custom claim with extended MVC Core Identity user
问题描述
如何在MVC Core 2.0(使用AspNetCore.identity)中创建自定义授权声明,以验证自定义用户布尔属性?我扩展了IdentityUser(ApplicationUser)以包括一个布尔值"IsDeveloper".我正在使用基于声明的身份验证,想添加自定义声明,但是不确定从哪里开始.如何创建自定义声明,该声明将:
How can I create a custom authorize claim in MVC Core 2.0 (using AspNetCore.identity) to verify a custom user boolean property? I have extended the IdentityUser (ApplicationUser) to include a boolean value "IsDeveloper". I am using claims based authentication and would like to add a custom claim, but am not certain where to start. How can I create a custom claim that will:
- 找到当前(自定义)Core.Identity用户.
- 评估自定义身份用户的布尔值?
我了解核心身份声明 MSDN:基于声明的身份验证,但是对于自定义声明来说是新手,所以我不确定从哪里开始.我找到的在线文档不起作用或不适合我的情况.
I understand the core identity claims MSDN: Claims Based Authentication, but am new to custom claims, so I am not sure where to begin. The Online documents that I have found do not work or does not fit my scenario.
推荐答案
因此,您需要在某处创建自定义声明,然后通过自定义策略或手动对其进行检查.
So, you need to create custom claims somewhere and then check it through a custom policy or manually.
您可以执行以下操作:
在返回jwt-token的控制器操作中,您可以添加custom claim
:
In your controller action that returns jwt-token you can add your custom claim
:
[HttpGet]
public dynamic GetToken(string login, string password)
{
var handler = new JwtSecurityTokenHandler();
var sec = "12312313212312313213213123123132123123132132132131231313212313232131231231313212313213132123131321313213213131231231213213131311";
var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(sec));
var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256Signature);
var user = GetUserFromDb(login);
var identity = new ClaimsIdentity(new GenericIdentity(user.Email), new[] { new Claim("user_id", user.Id) });
if (user.IsDeveloper)
identity.AddClaim(new Claim("IsDeveloper", "true"));
var token = handler.CreateJwtSecurityToken(subject: identity,
signingCredentials: signingCredentials,
audience: "ExampleAudience",
issuer: "ExampleIssuer",
expires: DateTime.UtcNow.AddSeconds(100));
return handler.WriteToken(token);
}
ASP.NET Core身份验证
您需要实现自定义IUserClaimsPrincipalFactory
或将UserClaimsPrincipalFactory
用作基类:
public class ApplicationClaimsIdentityFactory: Microsoft.AspNetCore.Identity.UserClaimsPrincipalFactory <ApplicationUser>
{
UserManager<ApplicationUser> _userManager;
public ApplicationClaimsIdentityFactory(UserManager<ApplicationUser> userManager,
IOptions<IdentityOptions> optionsAccessor):base(userManager, optionsAccessor)
{}
public async override Task<ClaimsPrincipal> CreateAsync(ApplicationUser user)
{
var principal = await base.CreateAsync(user);
if (user.IsDeveloper)
{
((ClaimsIdentity)principal.Identity).AddClaims(new[] {
new Claim("IsDeveloper", "true")
});
}
return principal;
}
}
然后您需要在Startup.ConfigureServices
中注册它:
then you need to register it in Startup.ConfigureServices
:
services.AddScoped<IUserClaimsPrincipalFactory<ApplicationUser>, ApplicationClaimsIdentityFactory>();
2)检查索赔
自定义政策
在Startup.ConfigureServices
中:
services.AddAuthorization(options =>
{
options.AddPolicy("Developer", policy =>
policy.RequireClaim("IsDeveloper", "true"));
});
保护开发人员的行动
[Authorize(Policy = "Developer"), HttpGet]
public string DeveloperSecret()
{
return "Hello Developer"
}
手动检查索赔
控制器中的某处:
Check the claim manually
Somewhere in the controller:
bool isDeveloper = User.Claims.Any(c => c.Type == "IsDeveloper" && c.Value == "true")
如果您使用其他身份验证,则想法应该相同.
If you are using some other authentication the idea should be the same.
这篇关于与扩展的MVC Core Identity用户实施自定义声明的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!