在《asp.net core认证与授权》中讲解了固定和自定义角色授权系统权限，其实我们还可以通过其他方式来授权，比如可以通过角色组，用户名，生日等，但这些主要取决于ClaimTypes，其实我们也可以自定义键值来授权，这些统一叫策略授权，其中更强大的是，我们可以自定义授权Handler来达到灵活授权，下面一一展开。

注意：下面的代码只是部分代码，完整代码参照：https://github.com/axzxs2001/Asp.NetCoreExperiment/tree/master/Asp.NetCoreExperiment/%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86/PolicyPrivilegeManagement

首先看基于角色组，或用户名，或基于ClaimType或自定义键值等授权策略，这些都是通过Services.AddAuthorization添加，并且是AuthorizationOptions来AddPolicy，这里策略的名称统一用RequireClaim来命名，不同的请求的策略名称各不相同，如用户名时就用policy.RequireUserName()，同时，在登录时，验证成功后，要添加相应的Claim到ClaimsIdentity中：

Startup.cs

         public void ConfigureServices(IServiceCollection services)

         {

             services.AddMvc();

             services.AddAuthorization(options =>

             {

 //基于角色组的策略

                 options.AddPolicy("RequireClaim", policy => policy.RequireRole("admin", "system"));

                 //基于用户名

                 //options.AddPolicy("RequireClaim", policy => policy.RequireUserName("桂素伟"));

                 //基于ClaimType

                 //options.AddPolicy("RequireClaim", policy => policy.RequireClaim(ClaimTypes.Country,"中国"));

                 //自定义值

                 // options.AddPolicy("RequireClaim", policy => policy.RequireClaim("date","2017-09-02"));

             }).AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>{

                 options.LoginPath = new PathString("/login");

                 options.AccessDeniedPath = new PathString("/denied");

             });

         }

HomeController.cs

 using System;

 using System.Collections.Generic;

 using System.Diagnostics;

 using System.Linq;

 using System.Threading.Tasks;

 using Microsoft.AspNetCore.Mvc;

 using PolicyPrivilegeManagement.Models;

 using Microsoft.AspNetCore.Authorization;

 using Microsoft.AspNetCore.Authentication;

 using Microsoft.AspNetCore.Authentication.Cookies;

 using System.Security.Claims;

 namespace PolicyPrivilegeManagement.Controllers

 {

     [Authorize(Policy = "RequireClaim")]

     public class HomeController : Controller

     {

         public IActionResult Index()

         {

             return View();

         }

         public IActionResult About()

         {

             ViewData["Message"] = "Your application description page.";

             return View();

         }

         public IActionResult Contact()

         {

             ViewData["Message"] = "Your contact page.";

             return View();

         }

         public IActionResult Error()

         {

             return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });

         }

         [AllowAnonymous]

         [HttpGet("login")]

         public IActionResult Login(string returnUrl = null)

         {

             TempData["returnUrl"] = returnUrl;

             return View();

         }

         [AllowAnonymous]

         [HttpPost("login")]

         public async Task<IActionResult> Login(string userName, string password, string returnUrl = null)

         {

             var list = new List<dynamic> {

                 new { UserName = "gsw", Password = "", Role = "admin",Name="桂素伟",Country="中国",Date="2017-09-02",BirthDay="1979-06-22"},

                 new { UserName = "aaa", Password = "", Role = "system",Name="测试A" ,Country="美国",Date="2017-09-03",BirthDay="1999-06-22"}

             };

             var user = list.SingleOrDefault(s => s.UserName == userName && s.Password == password);

             if (user != null)

             {

                 //用户标识

                 var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);

                 identity.AddClaim(new Claim(ClaimTypes.Sid, userName));

                 identity.AddClaim(new Claim(ClaimTypes.Name, user.Name));

                 identity.AddClaim(new Claim(ClaimTypes.Role, user.Role));

                 identity.AddClaim(new Claim(ClaimTypes.Country, user.Country));

                 identity.AddClaim(new Claim("date", user.Date));

                 await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));

                 if (returnUrl == null)

                 {

                     returnUrl = TempData["returnUrl"]?.ToString();

                 }

                 if (returnUrl != null)

                 {

                     return Redirect(returnUrl);

                 }

                 else

                 {

                     return RedirectToAction(nameof(HomeController.Index), "Home");

                 }

             }

             else

             {

                 const string badUserNameOrPasswordMessage = "用户名或密码错误！";

                 return BadRequest(badUserNameOrPasswordMessage);

             }

         }

         [HttpGet("logout")]

         public async Task<IActionResult> Logout()

         {

             await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

             return RedirectToAction("Index", "Home");

         }

         [AllowAnonymous]

         [HttpGet("denied")]

         public IActionResult Denied()

         {

             return View();

         }

     }

 }

上面的授权策略都相对简单，单一，使用场景也很有限，就和固定角色授权如出一辙，其实可以用更好的来例用授权，那就是自定义授权Handler，我们在《asp.net core认证与授权》一文中，是通过中间件来达到自定义解色的，现在我们换个思路，通过自定义授权Handler来实现。

首先定义一个UserPermission，即用户权限实体类

 /// <summary>

     /// 用户权限

     /// </summary>

     public class UserPermission

     {

         /// <summary>

         /// 用户名

         /// </summary>

         public string UserName

         { get; set; }

         /// <summary>

         /// 请求Url

         /// </summary>

         public string Url

         { get; set; }

     }

接下来定义一个PermissionRequirement，为请求条件实体类

 /// <summary>

     /// 必要参数类

     /// </summary>

     public class PermissionRequirement : IAuthorizationRequirement

     {

         /// <summary>

         /// 用户权限集合

         /// </summary>

         public  List<UserPermission> UserPermissions { get;private set; }

         /// <summary>

         /// 无权限action

         /// </summary>

         public string DeniedAction { get; set; }

         /// <summary>

         /// 构造

         /// </summary>

         /// <param name="deniedAction">无权限action</param>

         /// <param name="userPermissions">用户权限集合</param>

         public PermissionRequirement(string deniedAction, List<UserPermission> userPermissions)

         {

             DeniedAction = deniedAction;

             UserPermissions = userPermissions;

         }

     }

再定义自定义授权Hanlder，我们命名为PermissionHandler，此类必需继承AuthorizationHandler<T>，只用实现public virtual Task HandleAsync(AuthorizationHandlerContext context)，些方法是用户请求时验证是否授权的主方法，所以实现与自定义角色中间件的Invoke很相似。

 using Microsoft.AspNetCore.Authorization;

 using System.Collections.Generic;

 using System.Linq;

 using System.Security.Claims;

 using System.Threading.Tasks;

 namespace PolicyPrivilegeManagement.Models

 {

     /// <summary>

     /// 权限授权Handler

     /// </summary>

     public class PermissionHandler : AuthorizationHandler<PermissionRequirement>

     {

         /// <summary>

         /// 用户权限

         /// </summary>

         public List<UserPermission> UserPermissions { get; set; }

         protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)

         {

             //赋值用户权限

             UserPermissions = requirement.UserPermissions;

             //从AuthorizationHandlerContext转成HttpContext，以便取出表求信息

             var httpContext = (context.Resource as Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;

             //请求Url

             var questUrl = httpContext.Request.Path.Value.ToLower();

             //是否经过验证

             var isAuthenticated = httpContext.User.Identity.IsAuthenticated;

             if (isAuthenticated)

             {

                 if (UserPermissions.GroupBy(g => g.Url).Where(w => w.Key.ToLower() == questUrl).Count() > )

                 {

                     //用户名

                     var userName = httpContext.User.Claims.SingleOrDefault(s => s.Type == ClaimTypes.Sid).Value;

                     if (UserPermissions.Where(w => w.UserName == userName && w.Url.ToLower() == questUrl).Count() > )

                     {

                         context.Succeed(requirement);

                     }

                     else

                     {

                         //无权限跳转到拒绝页面

                         httpContext.Response.Redirect(requirement.DeniedAction );
                     } 
                 } 
                 else 
                 { 
                      context.Succeed(requirement); 
                 } 
              } 
              return Task.CompletedTask; 
           } 
      } 
 }

此次的Startup.cs的ConfigureServices发生了变化，如下

      public void ConfigureServices(IServiceCollection services)

         {

             services.AddMvc();

             services.AddAuthorization(options =>

             {

                  //自定义Requirement，userPermission可从数据库中获得

                 var userPermission= new List<UserPermission> {

                               new UserPermission {  Url="/", UserName="gsw"},

                               new UserPermission {  Url="/home/permissionadd", UserName="gsw"},

                               new UserPermission {  Url="/", UserName="aaa"},

                               new UserPermission {  Url="/home/contact", UserName="aaa"}

                           };

                 options.AddPolicy("Permission",

                           policy => policy.Requirements.Add(new PermissionRequirement("/denied", userPermission)));

             }).AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>{

                 options.LoginPath = new PathString("/login");

                 options.AccessDeniedPath = new PathString("/denied");

             });

             //注入授权Handler

             services.AddSingleton<IAuthorizationHandler, PermissionHandler>();

         }

HomeController中代码如下：

 using System.Collections.Generic;

 using System.Diagnostics;

 using System.Linq;

 using System.Threading.Tasks;

 using Microsoft.AspNetCore.Mvc;

 using PolicyPrivilegeManagement.Models;

 using Microsoft.AspNetCore.Authorization;

 using Microsoft.AspNetCore.Authentication;

 using Microsoft.AspNetCore.Authentication.Cookies;

 using System.Security.Claims;

 namespace PolicyPrivilegeManagement.Controllers

 {

     [Authorize(Policy = "Permission")]

     public class HomeController : Controller

     {

         PermissionHandler _permissionHandler;

         public HomeController(IAuthorizationHandler permissionHandler)

         {

             _permissionHandler = permissionHandler as PermissionHandler;

         }

         public IActionResult Index()

         {

             return View();

         }

         public IActionResult PermissionAdd()

         {

             return View();

         }

         [HttpPost("addpermission")]

         public IActionResult AddPermission(string url,string userName)

         {

             //添加权限

             _permissionHandler.UserPermissions.Add(new UserPermission { Url = url, UserName = userName });

             return Content("添加成功");

         }

         public IActionResult Contact()

         {

             ViewData["Message"] = "Your contact page.";

             return View();

         }

         public IActionResult Error()

         {

             return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });

         }

         [AllowAnonymous]

         [HttpGet("login")]

         public IActionResult Login(string returnUrl = null)

         {

             TempData["returnUrl"] = returnUrl;

             return View();

         }

         [AllowAnonymous]

         [HttpPost("login")]

         public async Task<IActionResult> Login(string userName, string password, string returnUrl = null)

         {

             var list = new List<dynamic> {

                 new { UserName = "gsw", Password = "", Role = "admin",Name="桂素伟",Country="中国",Date="2017-09-02",BirthDay="1979-06-22"},

                 new { UserName = "aaa", Password = "", Role = "system",Name="测试A" ,Country="美国",Date="2017-09-03",BirthDay="1999-06-22"}

             };

             var user = list.SingleOrDefault(s => s.UserName == userName && s.Password == password);

             if (user != null)

             {

                 //用户标识

                 var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);

                 identity.AddClaim(new Claim(ClaimTypes.Sid, userName));

                 identity.AddClaim(new Claim(ClaimTypes.Name, user.Name));

                 identity.AddClaim(new Claim(ClaimTypes.Role, user.Role));

                 identity.AddClaim(new Claim(ClaimTypes.Country, user.Country));

                 identity.AddClaim(new Claim("date", user.Date));

                 await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));

                 if (returnUrl == null)

                 {

                     returnUrl = TempData["returnUrl"]?.ToString();

                 }

                 if (returnUrl != null)

                 {

                     return Redirect(returnUrl);

                 }

                 else

                 {

                     return RedirectToAction(nameof(HomeController.Index), "Home");

                 }

             }

             else

             {

                 const string badUserNameOrPasswordMessage = "用户名或密码错误！";

                 return BadRequest(badUserNameOrPasswordMessage);

             }

         }

         [HttpGet("logout")]

         public async Task<IActionResult> Logout()

         {

             await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

             return RedirectToAction("Index", "Home");

         }

         [AllowAnonymous]

         [HttpGet("denied")]

         public IActionResult Denied()

         {

             return View();

         }

     }

 }

本例设计是当用户gsw密码111111登录时，是不能访问/home/contact的，刚登录时访该action是不成功的，这里我们在/home/addpermission中添加一个Action名称:/home/contact，用户名:gsw的信息，此时再访问/home/contact，会发现是可以访问的，这是因为我们热更新了PermissionHandler中的用户权限集合，用户的权限得到了扩展和变化。

其实用中间件能达到灵活权限的设置，用自定义授权Handler也可以，接下来比较一下两种做法的优劣：

中间件

自定义授权Handler

用户权限集合

静态对象

实体化对象

热更新时

用中间件名称.用户权限集合更新

因为在Startup.cs中，PermissionHandler是依赖注放的，可以在热更新的构造中获取并操作

性能方面

每个action请求都会触发Invock方法，标记[AllowAnonymous]特性的Action也会触发

只有标记[Authorize]特性的Action会触发该方法，标记[AllowAnonymous]特性的Action不会触发，性能更优化

最后，把授权策略做了个NuGet的包，大家可在asp.net core 2.0的项目中查询 AuthorizePolicy引用使用这个包，包对应的github地址：https://github.com/axzxs2001/AuthorizePolicy，欢迎大家提出建议，来共同完善这个授权策略。

最新文章

  1. Java 基础【10】 I/O流概念分析整理
  2. C# Color
  3. Google搜索质量评估员指南
  4. jQuery上传插件Uploadify使用帮助
  5. php--分享插件
  6. 131. 132. Palindrome Partitioning *HARD* -- 分割回文字符串
  7. exynos 4412 eMMC配置及使用方法
  8. sicily 1035. DNA matching
  9. Web Service 初步了解
  10. python 错误:&quot;&#39;NoneType&#39; object has no attribute &#39;execute&#39;&quot;
  11. [bzoj1143][CTSC2008]祭祀
  12. ES6(类）
  13. socket通信如何处理每次包长度不定问题
  14. laravel----------laravel一些注意事项和一些说明
  15. Linux Postfix 服务
  16. CentOS6.x下yum安装MySQL5.5/5.6
  17. Android日志工具的使用
  18. [LeetCode&amp;Python] Problem 429. N-ary Tree Level Order Traversal
  19. 笔记1：jmeter性能测试使用示例（原文：http://blog.csdn.net/zhongweijian/article/details/7619319）
  20. IDEA 中将已有项目放到 GitHub 上去

热门文章

  1. (转)生产者/消费者问题的多种Java实现方式 （待整理）
  2. jquery中防止冒泡事件
  3. [PS相关]DAS,NAS,SAN三种存储技术比较
  4. CubieBoard开发板不用ttl线也不用hdmi线的安装方法
  5. 【干货】一篇文章学会Gulp（Getting started with Gulp）
  6. iOS与web交互的那些事
  7. log4go的日志滚动处理——适应生产环境的需要
  8. 简单探讨python中的语句和语法
  9. crm踩坑记(二)
  10. 使用xlrd模块从excel文件中导入数据