Blazor服務器中基于動態角色的授權

我是 blazor 服務器的新手。我已經實作了asp.net核心身份基于角色的授權。但我不想在 Authorize 屬性上對角色進行硬編碼。我想稍后創建角色并指定它可以在不接觸源代碼的情況下訪問哪個控制器和操作。

如上圖所示，如何在 blazor 服務器中創建基于角色的動態授權

uj5u.com熱心網友回復：

您需要通過策略實施和授權。

您可以創建可以分配給任何Role. 與Policy檢查權限的a 結合使用。

這允許您在運行時創建角色并為這些新角色分配權限。當用戶被分配一個角色時，策略將看到附加到該角色的權限。

檔案

您的螢屏將成為分配給每個角色的 6 個權限的分組。這將需要 6 個策略。

我會考慮使用如下類：

Permission.cs

public sealed class Permission
{
    public static readonly IReadOnlyList<Permission> Permissions = new List<Permission>
    { RolesView, RolesCreate, RolesUpdate, RolesDelete, UserRoleView, UserRoleUpdate };

    public static explicit operator string(Permission p) => p.Key;

    public static Permission RolesView => new Permission
    {
        Key = "Permission.Roles.View",
        Display = "Role List",
        GroupName = "Role Management"
    };
    public static Permission RolesCreate => new Permission
    {
        Key = "Permission.Roles.Create",
        Display = "Create Role",
        GroupName = "Role Management"
    };
    public static Permission RolesUpdate => new Permission
    {
        Key = "Permission.Roles.Update",
        Display = "Edit Role",
        GroupName = "Role Management"
    };
    public static Permission RolesDelete => new Permission
    {
        Key = "Permission.Roles.Delete",
        Display = "Delete",
        GroupName = "Role Management"
    };
    public static Permission UserRoleView => new Permission
    {
        Key = "Permission.UserRole.View",
        Display = "User List",
        GroupName = "User Role Management"
    };
    public static Permission UserRoleUpdate => new Permission
    {
        Key = "Permission.UserRole.Update",
        Display = "Edit User Roles",
        GroupName = "User Role Management"
    };

    public string Key { get; private set; }
    public string Display { get; private set; }
    public string GroupName { get; private set; }
}

services.AddAuthorization(options =>
{
    ...
    options.AddPolicy(name: "UserRoleView", policy =>
            policy.RequireClaim(Permission.UserRoleView));
    ...
});

[Authorize(Policy = "UserRoleView")]

使用RoleManagers 方法AddClaimAsync&RemoveClaimAsync使用Permission作為利用顯式字串轉換的宣告。

uj5u.com熱心網友回復：

作為布賴恩答案的補充PolicyBuilder，您可以使用一個工廠來制定您的政策。這是我的一個應用程式中的一個簡單示例：

public static class AppPolicies
{
    public const string IsAdmin = "IsAdmin";
    public const string IsUser = "IsUser";
    public const string IsVisitor = "IsVisitor";

    public static AuthorizationPolicy IsAdminPolicy
        => new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .RequireRole("Admin")
        .Build();

    public static AuthorizationPolicy IsUserPolicy
        => new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .RequireRole("Admin", "User")
        .Build();

    public static AuthorizationPolicy IsVisitorPolicy
        => new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .RequireRole("Admin", "User", "Visitor")
        .Build();

    public static Dictionary<string, AuthorizationPolicy> Policies
    {
        get
        {
            var policies = new Dictionary<string, AuthorizationPolicy>();
            policies.Add(IsAdmin, IsAdminPolicy);
            policies.Add(IsUser, IsUserPolicy);
            policies.Add(IsVisitor, IsVisitorPolicy);
            return policies;
        }
    }
}

并像這樣使用它：

        services.AddAuthorization(config =>
        {
            foreach (var policy in AppPolicies.Policies) 
            {
                config.AddPolicy(policy.Key, policy.Value);
            }
        });

標籤：asp.net核心 西装外套 blazor 服务器端

上一篇：Razor頁面當我從post方法呼叫它時，我丟失了從用戶頁面傳遞的用戶資料

下一篇：無法在ASP.NET6CoreWebAPI中搭建控制器