如何在 .NET Core 中基于策略的授权中添加应用程序逻辑答案

【问题标题】：How to add application logic in policy based authorization in .NET Core如何在 .NET Core 中基于策略的授权中添加应用程序逻辑
【发布时间】：2023-01-12 23:24:38
【问题描述】：

我有当前的设置工作，但我收到这样的错误：

An attempt was made to use the context instance while it is being configured. 
A DbContext instance cannot be used inside 'OnConfiguring' since it is still being configured at this point. 
This can happen if a second operation is started on this context instance before a previous operation completed. 
Any instance members are not guaranteed to be thread safe.

我创造了IAuthorizationRequirement

public class ValidGroupsRequirement : IAuthorizationRequirement
{
    private IAuthenticationService _authenticationService;
    public async Task<bool> ValidateAccess(IAuthenticationService authenticationService, List<string> groups)
    {
        _authenticationService = authenticationService;
        var result = await _authenticationService.AllGroupsExist(groups);
        return result;
    }
}

还授权处理器

public class GroupsValidationHandler : AuthorizationHandler<ValidGroupsRequirement>
{
    private readonly IAuthenticationService authenticationService;
    
    public GroupsValidationHandler(IAuthenticationService authenticationService)
    {
        this.authenticationService = authenticationService;
    }
    
    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, ValidGroupsRequirement requirement)
    {
        var userGroups = context.User.FindAll("groups").Select(X => X.Value).ToList();
        var result = await requirement.ValidateAccess(authenticationService, userGroups);
        if (result)
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
            var filterContext = context.Resource as DefaultHttpContext;
            var response = filterContext.HttpContext.Response;
            response.OnStarting(async () =>
            {
                filterContext.HttpContext.Response.StatusCode = 401;
            });
        }
    }
}

我已经将它们注册在程序.cs

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ValidateGroups", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.AddRequirements(new ValidGroupsRequirement());
    });
    options.InvokeHandlersAfterFailure = false;
});

builder.Services.AddScoped<IAuthenticationService, AuthenticationService>();

我在身份验证服务中遇到错误。

因为我将它传递给要求，是否有可能不正确处理它？

我知道有一种方法可以在没有要求的情况下创建处理程序，但是 context.Succeed() 方法只接受要求。我应该如何注册它程序.cs

谢谢

【问题讨论】：

标签： c# .net asp.net-core authorization

【解决方案1】：

基于策略的授权框架旨在解耦授权和应用程序逻辑。简而言之，策略是设计为要求集合的实体，这些要求本身就是当前用户必须满足的条件。

【讨论】：