정책 기반 권한 부여

정책 모델

[Authorize(Policy = "CanManageOrders")]

AddAuthorization

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanManageOrders", policy =>
        policy.RequireRole("admin", "sales"));
});

RequireAuthenticatedUser

options.AddPolicy("SignedIn", policy =>
    policy.RequireAuthenticatedUser());

요구 사항 구성하기

options.AddPolicy("SeniorEditor", policy =>
    policy
        .RequireAuthenticatedUser()
        .RequireRole("editor")
        .RequireClaim("seniority", "senior"));

기본 정책

options.DefaultPolicy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .RequireClaim("email_verified", "true")
    .Build();

대체 정책

options.FallbackPolicy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .Build();
// Now every endpoint requires auth unless marked [AllowAnonymous]

AllowAnonymous로 제외하기

[AllowAnonymous]
[HttpGet("health")]
public IActionResult Health() => Ok("healthy");

엔드포인트에 정책 적용하기

// Controller
[Authorize(Policy = "SeniorEditor")]
public IActionResult Publish() => Ok();

// Minimal API
app.MapPost("/publish", () => Results.Ok())
   .RequireAuthorization("SeniorEditor");

엔드포인트 그룹화하기

var admin = app.MapGroup("/admin")
               .RequireAuthorization("CanManageOrders");

admin.MapGet("/stats", () => Results.Ok());
admin.MapDelete("/{id}", (int id) => Results.NoContent());

내부에서 처리되는 요구 사항

// RequireRole("admin") adds a RolesAuthorizationRequirement
// RequireClaim(...) adds a ClaimsAuthorizationRequirement

정책을 정의할 위치

public static IServiceCollection AddAppPolicies(
    this IServiceCollection services)
{
    services.AddAuthorization(o =>
    {
        o.AddPolicy("SignedIn", p => p.RequireAuthenticatedUser());
        o.AddPolicy("CanManageOrders", p => p.RequireRole("admin"));
    });
    return services;
}

빠른 확인

요약