How to create a custom Authorize attribute for multiple policies in ASP.NET CORE

Question

I want to authorize an action controller could access by multiple policies.

.e.g:

[Authorize([Policies.ManageAllCalculationPolicy,Policies.ManageAllPriceListPolicy]]
public async Task<IActionResult> Get(int id){}

Thank a lot.

Answer 1

For multiple policies, you could implement your own AuthorizeAttribute.

• AuthorizeMultiplePolicyAttribute

   public class AuthorizeMultiplePolicyAttribute:TypeFilterAttribute
   {
   public AuthorizeMultiplePolicyAttribute(string policies,bool IsAll):base(typeof(AuthorizeMultiplePolicyFilter))
   {
       Arguments = new object[] { policies,IsAll};
   }
   }
  

• AuthorizeMultiplePolicyFilter

   public class AuthorizeMultiplePolicyFilter: IAsyncAuthorizationFilter
   {
   private readonly IAuthorizationService _authorization;
   public string _policies { get; private set; }
   public bool _isAll { get; set; }
   public AuthorizeMultiplePolicyFilter(string policies, bool IsAll,IAuthorizationService authorization)
   {
       _policies = policies;
       _authorization = authorization;
       _isAll = IsAll;
   }
  
   public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
   {
  
       var policys = _policies.Split(";").ToList();
       if (_isAll)
       {
           foreach (var policy in policys)
           {
               var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
               if (!authorized.Succeeded)
               {
                   context.Result = new ForbidResult();
                   return;
               }
           }
       }
       else
       {
           foreach (var policy in policys)
           {
               var authorized = await _authorization.AuthorizeAsync(context.HttpContext.User, policy);
               if (authorized.Succeeded)
               {
                   return;
               }
           }
           context.Result = new ForbidResult();
           return;
       }
   }
   }
  

• Add Policy you want on Startup

   services.AddAuthorization(options =>
       {
  
           options.AddPolicy("ManageAllCalculationPolicy", policy =>
                   policy.RequireAssertion(context =>
                       context.User.HasClaim(c => c.Type == "BadgeId")));
  
           options.AddPolicy("ManageAllPriceListPolicy", policy =>
                   policy.RequireAssertion(context =>
                       context.User.HasClaim(c => c.Type == "aaaa")));
       });
  

• Authorization based on one of the policies

   [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", false)]
  

• Authorization based on all policies

   [AuthorizeMultiplePolicy("ManageAllCalculationPolicy;ManageAllPriceListPolicy", true)]
  

Answer 2

No, you cannot add multiple policies as a list with condition or. I think NetCore does not support that.

Try to create a new policy.

services.AddAuthorization(options =>
{
    options.AddPolicy("BadgeEntry", policy =>
        policy.RequireAssertion(context =>
            context.User.HasClaim(c =>
                (c.Type == ClaimTypes.BadgeId ||
                 c.Type == ClaimTypes.TemporaryBadgeId) &&
                 c.Issuer == "https://microsoftsecurity")));
});

Reference: https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-2.1#why-would-i-want-multiple-handlers-for-a-requirement