ASP.net的资源授权使用身份服务器的WEP API

我有一个使用身份服务器进行身份验证的ASP.net MVC5客户端（WEBAPP）。我使用下面的代码来访问web api。从Identity Server的ASP.net的资源授权使用身份服务器的WEP API

private async Task<TokenResponse> GetTokenAsync() 
    { 
     var client = new TokenClient(
      "https://localhost:44301/identity/connect/token", 
      "mvc_service", 
      "secret"); 

     return await client.RequestClientCredentialsAsync("sampleApi"); 
    }

而且使用访问令牌

1.Get访问令牌，我打电话的WebAPI

  var client = new HttpClient();     
      client.SetBearerToken(token); 
      var gg = this.HttpContext; 
      var json = await client.GetStringAsync("http://localhost:50990/jarvis"); 
      var jsonStr = JArray.Parse(json).ToString(); 
      var model = JsonConvert.DeserializeObject<List<User>>(jsonStr);

的网络API由身份提供服务器和资源Authotization担保由IdentityServer（Thinktecture.IdentityModel.Owin.ResourceAuthorization.WebApi）

APIController如下

[Authorize] 
public class AuthorizationController : ApiController 
{ 
    [ResourceAuthorize(AuthorizationResources.AdminActions.Create, AuthorizationResources.Admin)] 
    public async Task<IHttpActionResult> Get() 
    { 
     var user = User as ClaimsPrincipal; 

     List<User> usersList = await GetUsers(); 
     return Json(usersList); 
    } 
}

而且我ResourceAuthorize是如下

ResourceAuthorize

public class APIAuthorization: ResourceAuthorizationManager 
{ 
    public override Task<bool> CheckAccessAsync(ResourceAuthorizationContext context) 
    { 
     var resource = context.Resource.First().Value; 

     if (resource == AuthorizationResources.Admin) 
     { 
      return CheckAdminAccessAsync(context); 
     } 

     if (resource == AuthorizationResources.Editor) 
     { 
      return CheckEditorAccessAsync(context); 
     } 

     if (resource == AuthorizationResources.Reader) 
     { 
      return CheckReaderAccessAsync(context); 
     } 

     return Nok(); 
    } 

    private Task<bool> CheckReaderAccessAsync(ResourceAuthorizationContext context) 
    { 
     return Eval(context.Principal.IsInRole("Admin")); 
    } 

    private Task<bool> CheckEditorAccessAsync(ResourceAuthorizationContext context) 
    { 
     return Eval(context.Principal.IsInRole("Admin")); 
    } 

    private Task<bool> CheckAdminAccessAsync(ResourceAuthorizationContext context) 
    { 
     return Eval(context.Principal.IsInRole("Admin")); 
    } 
}

我的问题是

我如何通过索赔到的WebAPI这样我就可以做一次检查中APIA授权： Eval（context.Principal.IsInRole（“Admin”））
这是做资源授权的正确方法吗？

来源

2016-07-21 Naveen Kumar

基本上我是一个桌面开发。我是新来的网络应用程序 –

 app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions 
     { 
      Authority = "https://localhost:44333/core", 
      RequiredScopes = new[] { "profile", "openid" }, 
     });**This is what i was looking for , This solved my problem**

来源

2016-10-05 18:37:40

ASP.net的资源授权使用身份服务器的WEP API

回答

相关问题