Security Utilities

(under construction) EDennis.AspNetCore.Base provides some utility classes for making security configuration a little easier. Some of the classes, such as AutoLoginMiddleware and MockClientAuthorizationMiddleware, are helpful in certain testing scenarios. Those classes are described in the Testing section of the Wiki. Other security classes, described below, support production code.

A Convention for Default Authorization Policies

With ASP.NET, the developer has freedom to choose how authorization policies are defined and named. In some cases, business needs might drive the development of sophisticated policies. As a default, however, the develop might find it convenient to have some default authorization policies. EDennis.AspNetCore.Base provides methods for generating a set of default policies that cover the entire app, all actions in specific controllers, or specific controller actions. These generated default policies are summarized in the following table:

Generating the Default Authorization Policies

The library provides an AddDefaultAuthorizationPolicyConvention class that uses Microsoft.AspNetCore.Mvc.ApplicationModels to build all of the default policies. To add this convention, include the following code in Startup.ConfigureServices:

services.AddMvc(options => {
    options.Conventions.Add(new AddDefaultAuthorizationPolicyConvention(
           HostingEnvironment, Configuration));
});

Behind the scenes, EDennis.AspNetCore.Base creates "Scope" claims for all of the generated default policies. Importantly, these scope claims must be attached to clients or users in an OAuth provider (e.g., IdentityServer) in order for the default security policies to work.

Automatic [Authorize('SomePolicy')]

In addition to building the default policies, you need to attach these policies to Authorize attributes for specific controllers and actions. Of course, this can be done manually, by adding [Authorize('SomePolicy'}]; however, EDennis.AspNetCore.Base provides an IServiceCollection extension method for generating all of the appropriate Authorize attributes behind the scenes. This method is AddClientAuthenticationAndAuthorizationWithDefaultPolicies, and it can be invoked from within Startup.ConfigureServices as such:

services.AddClientAuthenticationAndAuthorizationWithDefaultPolicies();

Please note that the above extension method has been designed to work with Identity Server 4. In order for Identity Server 4 to work properly, it must be configured. Also, there may be additional required setup work in the Startup class (e.g. calling app.UseAuthentication() in Startup.Configure).