.net 核心 [授权] 将 ClaimsIdentity 与 AAD 组一起使用 [英] .net core [Authorize] using ClaimsIdentity with AAD groups

问题描述

我在 ((System.Security.Claims.ClaimsIdentity)User.Identity).Claims 中看到了这一点:

I am seeing this in my ((System.Security.Claims.ClaimsIdentity)User.Identity).Claims:

如何使用从 Azure AD 获取的这些组 GUID(以基于组成员身份保护端点)?

How do I make use of these group GUID's I am getting from our Azure AD (to secure the endpoint based on group membership)?

[Authorize(Roles="<group guid here>")]

或

[Authorize("<group guid here>")]

或者我需要在 startup.cs 文件中进行设置吗?

Or do I need to set something up in the startup.cs file?

推荐答案

您可以在 asp.net core 中使用策略，使用具有命名策略的属性，然后在启动时定义策略以要求组声明并设置允许的组 ID:

You could use policy in asp.net core , use an attribute with a named policy then you define the policy in startup to require group claim and set allowed Group ID :

        public void ConfigureServices(IServiceCollection services)
        {
            // Add MVC services to the services container.
            services.AddMvc();

            // Add Authentication services.
            services.AddAuthentication(sharedOptions => sharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);


            services.AddAuthorization(options =>
            {
                options.AddPolicy(
                    "CanAccessGroup",
                    policyBuilder => policyBuilder.RequireClaim("groups", "8e39f882-3453-4aeb-9efa-f6ac6ad8e2e0"));
            });
        }

然后在控制器中:

 [Authorize(Policy = "CanAccessGroup")]
 public IActionResult Contact()
        {
            ViewData["Message"] = "Your contact page.";

            return View();
        }

如果组 id 不在用户组声明中，它会将用户重定向到访问拒绝页面，您也可以编写策略规则逻辑，如下所示 这里 .

If the group id is not in the user group claims, it will redirect user to access denied page , you could also write your policy rules logic as shown here .

这篇关于.net 核心 [授权] 将 ClaimsIdentity 与 AAD 组一起使用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！