Axletree.Utils.Authorization 1.0.0

Axletree.Utils.Authorization

Extracts a second authorization token used to bind user claims into dynamic policies with a custom AuthorizationAttribute.

Target .Net 6

Configuration

Bind claims from second auth token

Put the middleware responsible to extract the user claims from the second token into the app pipeline in this order:

    app.UseAuthentication();
    app.UseMiddleware<AuthorizationMiddleware>();
    app.UseAuthorization();

Inside the appSettings.json include a section Auth with the type of the claims inside this way.

    "Auth": {
...
        "ClaimSectionName": "[CLAIM TYPE]",
...
    }

Claim values must be structured this way:

    "[entity]:[permission]"

Token validation

It is always necessary to include a key to validate the token signature inside the auth section of the appSetting.json

    "Auth": {
...
        "AuthAppClientSecret": "[Secret key]",
...
    }

It can also be set to validate: -Issuer -Audience -Lifetime

Example Json:

    "Auth": {
        "ClaimSectionName": "[CLAIM TYPE]",
        "AuthAppClientSecret": "[Secret key]",
        "ValidateLifetime": "true",
        "ValidateAudience":  "false"
    }

Add dynamic Policy provider

In Program.cs include

    builder.Services.AddSingleton<IAuthorizationHandler, PermissionHandler>();
    builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionAuthorizationPolicyProvider>();

To replace default policy providers and default authorization handler. If the PermissionAuthorizeAttribute() is not used it falls back to default policy.

Usage

    [Authorize]
    public class SomethingController : BaseApiController
    {
        [HttpGet]
        [PermissionAuthorizeAttribute("something","read")]
        public IActionResult Get()
        {
            ...
        }

        [HttpGet]
        [PermissionAuthorizeAttribute("something", PermissionOperatorEnum.AND, new string[]{"read", "write"})]
        public IActionResult Create()
        {
            ...
        }
    }