ASP.NET Core使用JWT自定义角色并实现策略授权需要的接口_实用技巧_

 /// 
 /// API /// 
 public class ApiPermission { /// 
 /// API名称 /// 
 public virtual string Name { get; set; } /// 
 /// API地址 /// 
 public virtual string Url { get; set; } } 

namespace Microsoft.AspNetCore.Authorization { // // 摘要: // Represents an authorization requirement. public interface IAuthorizationRequirement { } } 

 //IAuthorizationRequirement 是 Microsoft.AspNetCore.Authorization 接口 /// 
 /// 用户认证信息必要参数类 /// 
 public class PermissionRequirement : IAuthorizationRequirement { /// 
 /// 用户所属角色 /// 
 public Role Roles { get; set; } = new Role(); public void SetRolesName(string roleName) { Roles.Name = roleName; } /// 
 /// 无权限时跳转到此API /// 
 public string DeniedAction { get; set; } /// 
 /// 认证授权类型 /// 
 public string ClaimType { internal get; set; } /// 
 /// 未授权时跳转 /// 
 public string LoginPath { get; set; } = "/Account/Login"; /// 
 /// 发行人 /// 
 public string Issuer { get; set; } /// 
 /// 订阅人 /// 
 public string Audience { get; set; } /// 
 /// 过期时间 /// 
 public TimeSpan Expiration { get; set; } /// 
 /// 颁发时间 /// 
 public long IssuedTime { get; set; } /// 
 /// 签名验证 /// 
 public SigningCredentials SigningCredentials { get; set; } /// 
 /// 构造 /// 
 /// 无权限时跳转到此API /// 用户权限集合 /// 拒约请求的url /// 权限集合 /// 声明类型 /// 发行人 /// 订阅人 /// 颁发时间 /// 签名验证实体 public PermissionRequirement(string deniedAction, Role Role, string claimType, string issuer, string audience, SigningCredentials signingCredentials,long issusedTime, TimeSpan expiration) { ClaimType = claimType; DeniedAction = deniedAction; Roles = Role; Issuer = issuer; Audience = audience; Expiration = expiration; IssuedTime = issusedTime; SigningCredentials = signingCredentials; } } 

 public static TokenValidationParameters GetTokenValidationParameters() { var tokenValida = new TokenValidationParameters { // 定义 Token 内容 ValidateIssuerSigningKey = true, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(AuthConfig.SecurityKey)), ValidateIssuer = true, ValidIssuer = AuthConfig.Issuer, ValidateAudience = true, ValidAudience = AuthConfig.Audience, ValidateLifetime = true, ClockSkew = TimeSpan.Zero, RequireExpirationTime = true }; return tokenValida; } 

 /// 
 /// 获取基于JWT的Token /// 
 ///  ///  public static dynamic BuildJwtToken(Claim[] claims, PermissionRequirement permissionRequirement) { var now = DateTime.UtcNow; var jwt = new JwtSecurityToken( issuer: permissionRequirement.Issuer, audience: permissionRequirement.Audience, claims: claims, notBefore: now, expires: now.Add(permissionRequirement.Expiration), signingCredentials: permissionRequirement.SigningCredentials ); var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt); var response = new { Status = true, access_token = encodedJwt, expires_in = permissionRequirement.Expiration.TotalMilliseconds, token_type = "Bearer" }; return response; } 

 // 设置用于加密 Token 的密钥 // 配置角色权限 var roleRequirement = RolePermission.GetRoleRequirement(AccountHash.GetTokenSecurityKey()); // 定义如何生成用户的 Token var tokenValidationParameters = RolePermission.GetTokenValidationParameters(); 

 // 导入角色身份认证策略 services.AddAuthorization(options => { options.AddPolicy("Permission", policy => policy.Requirements.Add(roleRequirement)); // ↓ 身份认证类型 }).AddAuthentication(options => { options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme; options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; // ↓ Jwt 认证配置 }) .AddJwtBearer(options => { options.TokenValidationParameters = tokenValidationParameters; options.SaveToken = true; options.Events = new JwtBearerEvents() { // 在安全令牌通过验证和ClaimsIdentity通过验证之后调用 // 如果用户访问注销页面 OnTokenValidated = context => { if (context.Request.Path.Value.ToString() == "/account/logout") { var token = ((context as TokenValidatedContext).SecurityToken as JwtSecurityToken).RawData; } return Task.CompletedTask; } }; }); 

 // 添加 httpcontext 拦截 services.AddSingleton(); services.AddSingleton(roleRequirement); 

 app.UseAuthentication(); app.UseAuthorization(); 

 app.UseAuthorization(); app.UseAuthentication(); 

 /// 
 /// 登陆 /// 
 /// 用户名 /// 密码 /// Token信息 [HttpPost("login")] public JsonResult Login(string username, string password) { var user = UserModel.Users.FirstOrDefault(x => x.UserName == username && x.UserPossword == password); if (user == null) return new JsonResult( new ResponseModel { Code = 0, Message = "登陆失败!" }); // 配置用户标识 var userClaims = new Claim[] { new Claim(ClaimTypes.Name,user.UserName), new Claim(ClaimTypes.Role,user.Role), new Claim(ClaimTypes.Expiration,DateTime.Now.AddMinutes(_requirement.Expiration.TotalMinutes).ToString()), }; _requirement.SetRolesName(user.Role); // 生成用户标识 var identity = new ClaimsIdentity(JwtBearerDefaults.AuthenticationScheme); identity.AddClaims(userClaims); var token = JwtToken.BuildJwtToken(userClaims, _requirement); return new JsonResult( new ResponseModel { Code = 200, Message = "登陆成功!请注意保存你的 Token 凭证!", Data = token }); } 

 [Authorize(Policy = "Permission")] 

 /// 
 /// 验证用户信息，进行权限授权Handler /// 
 public class PermissionHandler : AuthorizationHandler { protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement) { List requirements = new List(); foreach (var item in context.Requirements) { requirements.Add((PermissionRequirement)item); } foreach (var item in requirements) { // 校验 颁发和接收对象 if (!(item.Issuer == AuthConfig.Issuer ? item.Audience == AuthConfig.Audience ? true : false : false)) { context.Fail(); } // 校验过期时间 var nowTime = DateTimeOffset.Now.ToUnixTimeSeconds(); var issued = item.IssuedTime +Convert.ToInt64(item.Expiration.TotalSeconds); if (issued < nowTime) context.Fail(); // 是否有访问此 API 的权限 var resource = ((Microsoft.AspNetCore.Routing.RouteEndpoint)context.Resource).RoutePattern; var permissions = item.Roles.Permissions.ToList(); var apis = permissions.Any(x => x.Name.ToLower() == item.Roles.Name.ToLower() && x.Url.ToLower() == resource.RawText.ToLower()); if (!apis) context.Fail(); context.Succeed(requirement); // 无权限时跳转到某个页面 //var httpcontext = new HttpContextAccessor(); //httpcontext.HttpContext.Response.Redirect(item.DeniedAction); } context.Succeed(requirement); return Task.CompletedTask; } } 

 public static class AccountHash { // 获取字符串的哈希值 public static string GetByHashString(string str) { string hash = GetMd5Hash(str.Replace("\"", String.Empty) .Replace("\'", String.Empty) .Replace("$", String.Empty)); return hash; } /// 
 /// 获取用于加密 Token 的密钥 /// 
 ///  public static SigningCredentials GetTokenSecurityKey() { var securityKey = new SigningCredentials( new SymmetricSecurityKey( Encoding.UTF8.GetBytes(AuthConfig.SecurityKey)), SecurityAlgorithms.HmacSha256); return securityKey; } private static string GetMd5Hash(string source) { MD5 md5Hash = MD5.Create(); byte[] data = md5Hash.ComputeHash(Encoding
                
提示：
                    本文由神整理自网络，如有侵权请联系本站删除！
                    

                    本站声明： 

                    1、本站所有资源均来源于互联网，不保证100%完整、不提供任何技术支持； 

                    2、本站所发布的文章以及附件仅限用于学习和研究目的;不得将用于商业或者非法用途；否则由此产生的法律后果，本站概不负责！
                
                

                

                                            
上一篇：.NET Core使用EF生成数据库出错的解决方法_实用技巧_
                                                                
下一篇：.Net Core部署Docker容器_基础应用_