Security Utilities

(under construction) EDennis.AspNetCore.Base provides some utility classes for making security configuration a little easier. Some of the classes, such as AutoLoginMiddleware and MockClientAuthorizationMiddleware, are helpful in certain testing scenarios. Those classes are described in the Testing section of the Wiki. Other security classes, described below, support production code.

{Application}.{Controller}.{Action} Default Policies

With ASP.NET, the developer has freedom to choose how authorization policies are defined and named. In some cases, business needs might drive the development of sophisticated policies. As a default, however, the develop might find it convenient to have some default authorization policies. EDennis.AspNetCore.Base provides methods for generating a set of default policies that cover each action in all controllers in the application model. The naming convention for the default policies is:

Automatic Generation of [Authorize(Policy="{Application}.{Controller}.{Action}")] for All Controller Actions

EDennis.AspNetCore.Base will generate a set of behind-the-scenes Authorize attributes for each controller action in the application model. Using the Microsoft.AspNetCore.Mvc.ApplicationModels (to ensure that all controllers and actions are identified), the AddDefaultAuthorizationPolicyConvention class creates each Authorize attribute with a reference to the appropriate policy for the controller action. The class also caches the list of default policies in Configuration so that corresponding policies can be created upon first access to any controller action.

To activate AddDefaultAuthorizationPolicyConvention, include the following code in Startup.ConfigureServices:

services.AddMvc(options => {
    options.Conventions.Add(new AddDefaultAuthorizationPolicyConvention(
           HostingEnvironment, Configuration));
});

Creation of {Application}.{Controller}.{Action} Policies

EDennis.AspNetCore.Base uses a DefaultPoliciesAuthorizationPolicyProvider to generate and retrieve all of the default policies. Upon first access to any controller action, the policies are created by iterating over the list of default policies contained in the "DefaultPolicy" section of configuration (generated by the above convention).

To set up DefaultPoliciesAuthorizationPolicyProvider, include the following code in Startup.ConfigureServices:

//NOTE: ClientSecret must be defined in "Security" section of configuration
var securityOptions = new SecurityOptions();
Configuration.GetSection("Security").Bind(securityOptions);

//NOTE: this method name is shortened in the 3.0 version of EDennis.AspNetCore.Base
services.AddClientAuthenticationAndAuthorizationWithDefaultPolicies(securityOptions);

//add an AuthorizationPolicyProvider which generates default
//policies upon first access to any controller action
services.AddSingleton<IAuthorizationPolicyProvider>(
       new DefaultPoliciesAuthorizationPolicyProvider(
          Configuration, securityOptions.ScopePatternOptions,Logger));

The first few lines read security options from a "Security" section of configuration. There are defaults for every security option, except the client secret, which must be provided. The call to "AddClientAuthentication..." sets up OAuth or OIDC configurations for Identity Server. The DefaultPoliciesAuthorizationProvider requires several constructor arguments for properly setting up the default policies.

Pattern Matching of {Application}.{Controller}.{Action} Policies

Default policies are checked by a custom ClaimPatternAuthorizationHandler, which supports wildcard matching against provided scope (and user_scope) claims. The pattern matching also supports exclusions through a configurable exclusion operator (default = -). The example below lists a number of default policies and which of the default policies are matched by various scope patterns.

#	Sample Default Policy
1	EDennis.Samples.DefaultPoliciesApi.Person.Index
2	EDennis.Samples.DefaultPoliciesApi.Person.Details
3	EDennis.Samples.DefaultPoliciesApi.Person.Create
4	EDennis.Samples.DefaultPoliciesApi.Person.Edit
5	EDennis.Samples.DefaultPoliciesApi.Person.Delete
6	EDennis.Samples.DefaultPoliciesApi.Position.Index
7	EDennis.Samples.DefaultPoliciesApi.Position.Details
8	EDennis.Samples.DefaultPoliciesApi.Position.Create
9	EDennis.Samples.DefaultPoliciesApi.Position.Edit
10	EDennis.Samples.DefaultPoliciesApi.Position.Delete

Scope Claim (Pattern)	Policies Matched
EDennis.Samples.DefaultPoliciesApi.*	(all of the above policies)
EDennis.Samples.DefaultPoliciesApi.Person.*	policies 1-5
EDennis.Samples.DefaultPoliciesApi.Position.*	policies 6-10
EDennis.Samples.DefaultPoliciesApi.Person.Index,EDennis.Samples.DefaultPoliciesApi.Person.Details	policies 1 and 2
EDennis.Samples.DefaultPoliciesApi.*Create*	policies 3 and 8
-EDennis.Samples.DefaultPoliciesApi.*Delete*	all policies, except 5 and 10
-EDennis.Samples.DefaultPoliciesApi.*Create*,-EDennis.Samples.DefaultPoliciesApi.*Delete*	all policies, except 3, 5, 8 and 10

Important Notes

Importantly, scope claims must be attached to clients or users in order for the default security policies to work. For example, clients may need to be configured in Identity Server. Users may need to be configured in ASP.NET identity. Also, there is additional setup work to do in Startup (e.g., calling app.UseAuthentication() in Startup.Configure). Please see Identity Server and Microsoft documentation for more information.