.Net Core 微服务和检查用于授权的 Cognito JWT 声明

Question

我正在开发一个 .net 服务，我在客户端传递一个 Cognito 生成的 JWT，它有一个组声明，我希望使用它来限制 API 访问，因为 JWT 作为 Bearer 传入来自前端的每个 API 调用的令牌。例如

"cognito:groups":["Guest"]

现在在我的代码中添加了：

    services.AddAuthentication(DefaultScheme = JwtBearerDefaults.AuthenticationScheme)
  .AddJwtBearer(options =>
        {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateAudience = false,
            RoleClaimType = "cognito:groups"
        };
    });

我已经使用 HeimGuard 项目设置了我的角色和权限。在测试中，当我更改我的 API 的 Bearer 令牌 none 中的角色时，限制对 Guest 的访问在使用 [Authorize] 装饰时不会拒绝访问。所以，什么都不受限制。您对如何解决此问题的任何想法或想法都非常有帮助。谢谢！！

Answer 1

我尝试了如下自定义 AuthorizeAttribute：

创建令牌：

public class UserModel
    {
        public string Username { get; set; }
        public string Role { get; set; }
        public string EmailAddress { get; set; }
        public string PassWord { get; set; }

        public string Right { get; set; }
    }

[HttpPost]
        public IActionResult Authenticate(UserModel someuser)
        {
            var claims = new Claim[]
            {
               new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
               new Claim(ClaimTypes.Role, someuser.Role), 
               new Claim(ClaimTypes.Name, someuser.Username), 
               new Claim("Right", someuser.Right) 
            };
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

           
            var token = new JwtSecurityToken(
                _config["Jwt:Issuer"],
              _config["Jwt:Issuer"],
              signingCredentials: credentials,
              expires: DateTime.Now.AddMinutes(2),
              claims: claims
            );

            string jwtToken = new JwtSecurityTokenHandler().WriteToken(token);
            
            return Content(jwtToken);
        }

appsettings.json 中的代码：

"Jwt": {
    "Key": "ThisismySecretKey",
    "Issuer": "Test.com"
  }

自定义要求：

public class WriteRequirement : AuthorizationHandler<WriteRequirement>, IAuthorizationRequirement
    {
        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, WriteRequirement requirement)
        {
            var right = context.User.FindFirst("Right").Value;
            if(right=="Write")
            {
                context.Succeed(requirement);
            }
            else
            {
                context.Fail();
            }
            return Task.CompletedTask;
        }

       
    }

正在启动class:

public void ConfigureServices(IServiceCollection services)
        {

            ...

            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                    .AddJwtBearer(options =>
                    {
                        options.TokenValidationParameters = new TokenValidationParameters
                        {
                            ValidateIssuer = false,
                            ValidateAudience = false,
                            ValidateLifetime = false,
                            ValidateIssuerSigningKey = false,
                            ValidIssuer = Configuration["Jwt:Issuer"],
                            ValidAudience = Configuration["Jwt:Issuer"],
                            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
                        };
                    });
            services.AddSingleton<IAuthorizationHandler, WriteRequirement>();
            services.AddAuthorization(opyions => { opyions.AddPolicy("Write", policy => policy.Requirements.Add(new WriteRequirement())); });
            ...
        }

该动作需要授权：

[HttpGet]
        [Authorize(Roles ="Admin")]
        [Authorize(Policy="Write")]
        public ActionResult<IEnumerable<string>> Get()
        {
            return new string[] { "value1", "value2", "value3", "value4", "value5" };
        }

结果：

.Net Core 微服务和检查用于授权的 Cognito JWT 声明

.Net Core microservice and inspecting Cognito JWT claims for use in authorization

.net-core

asp.net-core

asp.net-core-webapi