사용자 지정 권한 부여 요구 사항

기본 제공 기능만으로 부족할 때

// Rule: user must be older than a configurable minimum age

IAuthorizationRequirement

public class MinimumAgeRequirement : IAuthorizationRequirement
{
    public int MinimumAge { get; }
    public MinimumAgeRequirement(int minimumAge) =>
        MinimumAge = minimumAge;
}

AuthorizationHandler

public class MinimumAgeHandler
    : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumAgeRequirement requirement)
    {
        // logic goes here
        return Task.CompletedTask;
    }
}

요구 사항 성공시키기

var dobClaim = context.User.FindFirst("birthdate");
if (dobClaim is null) return Task.CompletedTask;

var dob = DateTime.Parse(dobClaim.Value);
int age = DateTime.UtcNow.Year - dob.Year;
if (dob > DateTime.UtcNow.AddYears(-age)) age--;

if (age >= requirement.MinimumAge)
    context.Succeed(requirement);

return Task.CompletedTask;

Succeed를 사용하고 Fail은 사용하지 않기

// Soft: let other handlers also try
if (ok) context.Succeed(requirement);

// Hard: force failure no matter what
if (blocked) context.Fail();

처리기 등록하기

builder.Services.AddSingleton<
    IAuthorizationHandler, MinimumAgeHandler>();

정책에 연결하기

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AtLeast18", policy =>
        policy.AddRequirements(new MinimumAgeRequirement(18)));
});

정책 사용하기

[Authorize(Policy = "AtLeast18")]
[HttpGet("age-restricted")]
public IActionResult Restricted() => Ok();

리소스 기반 권한 부여

public class OwnerHandler
    : AuthorizationHandler<OwnerRequirement, Document>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        OwnerRequirement requirement,
        Document resource)
    {
        var userId = context.User.FindFirstValue(
            ClaimTypes.NameIdentifier);
        if (resource.OwnerId.ToString() == userId)
            context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

IAuthorizationService 호출하기

public async Task<IActionResult> Edit(int id)
{
    var doc = await _db.Documents.FindAsync(id);
    var result = await _authz.AuthorizeAsync(
        User, doc, "DocumentOwner");
    if (!result.Succeeded) return Forbid();
    return Ok(doc);
}

요구 사항당 여러 처리기 사용하기

// e.g. allow if owner OR if admin role
services.AddSingleton<IAuthorizationHandler, OwnerHandler>();
services.AddSingleton<IAuthorizationHandler, AdminOverrideHandler>();

빠른 확인

요약