|
| 1 | +using Microsoft.AspNetCore.Authorization; |
| 2 | +using Microsoft.Extensions.DependencyInjection; |
| 3 | +using System; |
| 4 | +using System.Collections.Generic; |
| 5 | +using System.Linq; |
| 6 | +using System.Security.Claims; |
| 7 | +using System.Text; |
| 8 | +using System.Threading.Tasks; |
| 9 | + |
| 10 | +namespace Shared.Authorisation |
| 11 | +{ |
| 12 | + public static class AuthorizationExtensions { |
| 13 | + public static IServiceCollection AddClientCredentialsHandler(this IServiceCollection services) { |
| 14 | + services.AddSingleton<IAuthorizationHandler, ClientCredentialsHandler>(); |
| 15 | + return services; |
| 16 | + } |
| 17 | + |
| 18 | + public static IServiceCollection AddClientCredentialsOnlyPolicy(this IServiceCollection services) { |
| 19 | + services.AddAuthorization(options => { |
| 20 | + options.AddPolicy("ClientCredentialsOnly", policy => |
| 21 | + policy.Requirements.Add(new ClientCredentialsRequirement())); |
| 22 | + }); |
| 23 | + |
| 24 | + return services; |
| 25 | + } |
| 26 | + |
| 27 | + public static IServiceCollection AddPasswordTokenHandler(this IServiceCollection services) |
| 28 | + { |
| 29 | + services.AddSingleton<IAuthorizationHandler, PasswordTokenHandler>(); |
| 30 | + return services; |
| 31 | + } |
| 32 | + |
| 33 | + public static IServiceCollection AddPasswordTokenPolicy(this IServiceCollection services) |
| 34 | + { |
| 35 | + services.AddAuthorization(options => |
| 36 | + { |
| 37 | + options.AddPolicy("PasswordToken", policy => |
| 38 | + policy.Requirements.Add(new PasswordTokenRequirement())); |
| 39 | + }); |
| 40 | + |
| 41 | + return services; |
| 42 | + } |
| 43 | + |
| 44 | + |
| 45 | + private sealed class PasswordTokenRequirement : IAuthorizationRequirement; |
| 46 | + |
| 47 | + private sealed class ClientCredentialsRequirement : IAuthorizationRequirement; |
| 48 | + |
| 49 | + private sealed class PasswordTokenHandler : AuthorizationHandler<PasswordTokenRequirement> { |
| 50 | + protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, |
| 51 | + PasswordTokenRequirement requirement) { |
| 52 | + // Your logic from IsPasswordToken() |
| 53 | + Claim? userIdClaim = context.User.Claims.SingleOrDefault(c => c.Type == ClaimTypes.NameIdentifier); |
| 54 | + |
| 55 | + if (userIdClaim != null) { |
| 56 | + context.Succeed(requirement); |
| 57 | + } |
| 58 | + |
| 59 | + return Task.CompletedTask; |
| 60 | + } |
| 61 | + } |
| 62 | + |
| 63 | + private sealed class ClientCredentialsHandler : AuthorizationHandler<ClientCredentialsRequirement> { |
| 64 | + protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, |
| 65 | + ClientCredentialsRequirement requirement) { |
| 66 | + // A client credentials token *does not* include a NameIdentifier (user) claim. |
| 67 | + bool isUserToken = context.User.HasClaim(c => c.Type == ClaimTypes.NameIdentifier); |
| 68 | + |
| 69 | + if (!isUserToken) { |
| 70 | + context.Succeed(requirement); // Valid client credentials token |
| 71 | + } |
| 72 | + |
| 73 | + return Task.CompletedTask; |
| 74 | + } |
| 75 | + } |
| 76 | + |
| 77 | + } |
| 78 | +} |
0 commit comments