Policy-Based And Role-Based Authorization In ASP.NET Core 3.0 Using Custom Handler

Introduction

Authentication is the process of determining or giving individual access to system or user based on their identity. This article demonstrates how to add custom Policy-based & Role-based Authorization in ASP.NET Core 3.0

In the simple case of Authentication, we generally use the username and the password for login and based on that we are providing access to the application, but in this case, the user can access all the resources of the application. By using Policy-based & Role-based Authorization process, we can provide access to particular area of application to the user based on the Role/Policy of the user.

In this demonstration, I am going to use cookies to store user information. Readers can use a database to store user information.

Prerequisites

Install .NET Core 3.0.0 or above SDK from here.
Install the latest version of Visual Studio 2019 Community Edition from here.

Steps for creating a web application

Please check my existing article, Cookie Authentication In .NET Core 3.0 for project setup. Here I have explained step by step how to create project? and how to manage authentication?

Code for the Basic Authorization

If you want to add simple Authentication and want to define only Role/Policy with authorization tag for authorizing action/controller like in the below syntax, then you can go with simple configuration. AuthorizationPolicyBuilderclass helps you to achieve this requirement.

Add Authorize tag on controller with Policy/Role

[Authorize(Policy = "UserPolicy")]
[Authorize(Roles = "Admin")]
public class HomeController : Controller
{
}

Add Authorize tag on action with Policy/Role

[Authorize(Policy = "UserPolicy")]
public ActionResult UsersPolicy()
{
var uses = new Users();
return View("Users", uses.GetUsers());
}
[Authorize(Roles = "User")]
public ActionResult UsersRole()
{
var uses = new Users();
return View("Users", uses.GetUsers());
}

Update Startup.cs file with below code

using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
namespace CookieAuthenticationDemo
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthentication("CookieAuthentication")
.AddCookie("CookieAuthentication", config =>
{
config.Cookie.Name = "UserLoginCookie"; // Name of cookie
config.LoginPath = "/Login/UserLogin"; // Path for the redirect to user login page
});
services.AddAuthorization(config =>
{
var userAuthPolicyBuilder = new AuthorizationPolicyBuilder();
config.DefaultPolicy = userAuthPolicyBuilder
.RequireAuthenticatedUser()
.RequireClaim(ClaimTypes.DateOfBirth)
.Build();
});
services.AddControllersWithViews();
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}");
});
}
}
}

Integrate Custom Authorization Handler

Step 1

Create a new folder with the name CustomHandler and add the below classes into it.

Class 1 - AuthorizationPolicyBuilderExtension: User defined static class for addding a new policy for Authorization using AuthorizationPolicyBuilder.

Class 2 - CustomUserRequireClaim: User defined class inherits from IAuthorizationRequirement interface. IAuthorizationRequirement interface does not contain any method. This is an empty marker service.

Class 3 - PoliciesAuthorizationHandler: User defined class inherits from AuthorizationHandler class. TheHandleRequirementAsync method of AuthorizationHandler class

helps to validate user based on policy.

Class 4 - RolesAuthorizationHandler: Same like PoliciesAuthorizationHandler class. This class helps to validate user based on Role.

Code for CustomUserRequireClaim: Put the below lines of code intoCustomUserRequireClaim class.

using Microsoft.AspNetCore.Authorization;
using System.Linq;
using System.Threading.Tasks;
namespace CookieAuthenticationDemo.CustomHandler
{
public class CustomUserRequireClaim : IAuthorizationRequirement
{
public string ClaimType { get; }
public CustomUserRequireClaim(string claimType)
{
ClaimType = claimType;
}
}
}

Code for AuthorizationPolicyBuilderExtension - Put the below lines of code intoAuthorizationPolicyBuilderExtension class.

using Microsoft.AspNetCore.Authorization;
namespace CookieAuthenticationDemo.CustomHandler
{
public static class AuthorizationPolicyBuilderExtension
{
public static AuthorizationPolicyBuilder UserRequireCustomClaim(this AuthorizationPolicyBuilder builder, string claimType)
{
builder.AddRequirements(new CustomUserRequireClaim(claimType));
return builder;
}
}
}

Code for PoliciesAuthorizationHandler - Put the below lines of code intoPoliciesAuthorizationHandler class.

using Microsoft.AspNetCore.Authorization;
using System.Linq;
using System.Threading.Tasks;
namespace CookieAuthenticationDemo.CustomHandler
{
public class PoliciesAuthorizationHandler : AuthorizationHandler<CustomUserRequireClaim>
{
protected override Task HandleRequirementAsync(
AuthorizationHandlerContext context,
CustomUserRequireClaim requirement)
{
if (context.User == null || !context.User.Identity.IsAuthenticated)
{
context.Fail();
return Task.CompletedTask;
}
var hasClaim = context.User.Claims.Any(x => x.Type == requirement.ClaimType);
if (hasClaim)
{
context.Succeed(requirement);
return Task.CompletedTask;
}
context.Fail();
return Task.CompletedTask;
}
}
}

Code for RolesAuthorizationHandler - Put the below lines of code intoRolesAuthorizationHandler class.

using CookieAuthenticationDemo.Models;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Infrastructure;
using System.Linq;
using System.Threading.Tasks;
namespace CookieAuthenticationDemo.CustomHandler
{
public class RolesAuthorizationHandler : AuthorizationHandler<RolesAuthorizationRequirement>, IAuthorizationHandler
{
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
RolesAuthorizationRequirement requirement)
{
if (context.User == null || !context.User.Identity.IsAuthenticated)
{
context.Fail();
return Task.CompletedTask;
}
var validRole = false;
if (requirement.AllowedRoles == null ||
requirement.AllowedRoles.Any() == false)
{
validRole = true;
}
else
{
var claims = context.User.Claims;
var userName = claims.FirstOrDefault(c => c.Type == "UserName").Value;
var roles = requirement.AllowedRoles;
validRole = new Users().GetUsers().Where(p => roles.Contains(p.Role) && p.UserName == userName).Any();
}
if (validRole)
{
context.Succeed(requirement);
}
else
{
context.Fail();
}
return Task.CompletedTask;
}
}
}

Changes In Users class - Update Users class as I mentioned. I have added Role and DateOfBirth extra properties here.

using System.Collections.Generic;
namespace CookieAuthenticationDemo.Models
{
public class Users
{
public int Id { get; set; }
public string UserName { get; set; }
public string Name { get; set; }
public string EmailId { get; set; }
public string Password { get; set; }
public string Role { get; set; }
public string DateOfBirth { get; set; }
public IEnumerable<Users> GetUsers()
{
return new List<Users>() { new Users { Id = 101, UserName = "anet", Name = "Anet", EmailId = "[email protected]", Password = "anet123", Role="Admin" , DateOfBirth = "01/01/2012"} };
}
}
}

Changes In LoginController class - Update LoginController class as I mention. I have added UserName and DateOfBirth extra claims here. Also, I have added UserAccessDenied action method. If the user has no policy/role then user will redirect to AccessDenied Page.

using CookieAuthenticationDemo.Models;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Mvc;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
namespace CookieAuthenticationDemo.Controllers
{
public class LoginController : Controller
{
[HttpGet]
public ActionResult UserLogin()
{
return View();
}
[HttpPost]
public ActionResult UserLogin([Bind] Users userModel)
{
// username = anet
var user = new Users().GetUsers().Where(u => u.UserName == userModel.UserName).SingleOrDefault();
if (user != null)
{
var userClaims = new List<Claim>()
{
new Claim("UserName", user.UserName),
new Claim(ClaimTypes.Name, user.Name),
new Claim(ClaimTypes.Email, user.EmailId),
new Claim(ClaimTypes.DateOfBirth, user.DateOfBirth),
new Claim(ClaimTypes.Role, user.Role)
};
var userIdentity = new ClaimsIdentity(userClaims, "User Identity");
var userPrincipal = new ClaimsPrincipal(new[] { userIdentity });
HttpContext.SignInAsync(userPrincipal);
return RedirectToAction("Index", "Home");
}
return View(user);
}
[HttpGet]
public ActionResult UserAccessDenied()
{
return View();
}
}
}

Add view for UserAccessDenied - Add a new view for the UserAccessDenied method and put the below lines of code into it.

<div class="alert-danger">
<h1>Access Denied </h1>
<h3>You dont have permission to view this resource.</h3>
</div>

Changes In HomeController class - Update HomeController class as I mention. I have updated Authorize tag with Policy And Role.

using CookieAuthenticationDemo.Models;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace CookieAuthenticationDemo.Controllers
{
public class HomeController : Controller
{
public IActionResult Index()
{
return View();
}
[Authorize]
public ActionResult Users()
{
var uses = new Users();
return View(uses.GetUsers());
}
[Authorize(Policy = "UserPolicy")]
public ActionResult UsersPolicy()
{
var uses = new Users();
return View("Users", uses.GetUsers());
}
[Authorize(Roles = "User")]
public ActionResult UsersRole()
{
var uses = new Users();
return View("Users", uses.GetUsers());
}
[Authorize(Roles = "Admin")]
public ActionResult AdminUser()
{
var uses = new Users();
return View("Users", uses.GetUsers());
}
}
}

Changes In Startup class - Update Startup class as I mention below. Check the AddPolicy method for how I added claims for user defined policy. Also, I have registered two handler services PoliciesAuthorizationHandler and RolesAuthorizationHandler of IAuthorizationHandler type.

using System.Security.Claims;
using CookieAuthenticationDemo.CustomHandler;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
namespace CookieAuthenticationDemo
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthentication("CookieAuthentication")
.AddCookie("CookieAuthentication", config =>
{
config.Cookie.Name = "UserLoginCookie"; // Name of cookie
config.LoginPath = "/Login/UserLogin"; // Path for the redirect to user login page
config.AccessDeniedPath = "/Login/UserAccessDenied";
});
services.AddAuthorization(config =>
{
config.AddPolicy("UserPolicy", policyBuilder =>
{
policyBuilder.UserRequireCustomClaim(ClaimTypes.Email);
policyBuilder.UserRequireCustomClaim(ClaimTypes.DateOfBirth);
});
});
services.AddScoped<IAuthorizationHandler, PoliciesAuthorizationHandler>();
services.AddScoped<IAuthorizationHandler, RolesAuthorizationHandler>();
services.AddControllersWithViews();
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
// who are you?
app.UseAuthentication();
// are you allowed?
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}");
});
}
}
}

Changes In _Layout.cshtml page - Update _Layout.cshtml as I mention below.

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>@ViewData["Title"] - CookieAuthenticationDemo</title>
<link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.min.css" />
<link rel="stylesheet" href="~/css/site.css" />
</head>
<body>
<header>
<nav class="navbar navbar-expand-sm navbar-toggleable-sm navbar-light bg-white border-bottom box-shadow mb-3">
<div class="container">
<a class="navbar-brand" asp-area="" asp-controller="Home" asp-action="Index">My Application</a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target=".navbar-collapse" aria-controls="navbarSupportedContent"
aria-expanded="false" aria-label="Toggle navigation">
<span class="navbar-toggler-icon"></span>
</button>
<div class="navbar-collapse collapse d-sm-inline-flex flex-sm-row-reverse">
<ul class="navbar-nav flex-grow-1">
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Index">Home</a>
</li>
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="UsersPolicy">Users Policy</a>
</li>
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="UsersRole">Users Role</a>
</li>
</ul>
</div>
</div>
</nav>
</header>
<div class="container">
<main role="main" class="pb-3">
@RenderBody()
</main>
</div>
<footer class="border-top footer text-muted">
<div class="container">
</div>
</footer>
<script src="~/lib/jquery/dist/jquery.min.js"></script>
<script src="~/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
<script src="~/js/site.js" asp-append-version="true"></script>
@RenderSection("Scripts", required: false)
</body>
</html>

Run your application

After successfully running your application, the output of your application should be like the below screen,

Policy-Based And Role-Based Authorization In ASP.NET Core 3.0 Using Custom Handler

Click on the UsersPolicy tab to check is whether the user has access here or not.

First, it will redirect to the login page for user authentication,

Enter Username as "anet" and password "anet" for login. After successfully logging in, now click on the Users Policy tab and check the result. Now the user can easily view information like below:

Now click on the Users Role tab. Here, the user cannot access that information and is redirected to the access denied page. I have given Admin role to the user, and for UserRole action method I have mentioned User role in Authorization tag,

Summary

In this article, I discussed how to add Custom Policy-based & Role-based Authorization in ASP.NET Core 3.0. We have also created a PoliciesAuthorizationHandler for handling policies and RolesAuthorizationHandler for roles. I hope this will help the readers to understand how to implement the custom authorization handler in any application. Please find the attached code for better understanding.

7 Comments

Join the conversation! Your thoughts help the community grow.

Hamid Khan4y ago
Very well explained
Faizan Syed6y ago
How to assigned attribute roles to requirement.AllowedRoles?
- Prashant Rewatkar6y ago
  We can add claims for this like new Claim(ClaimTypes.Role, user.Role) and for more controls on authorization then go with Authorization Handler "RolesAuthorizationHandler"
Renan Barbosa6y ago
How to show user name authenticated in navbar?
- Syed Khaleel6y ago
  You can use this line @User.Identity.Name
Prakash Tripathi6y ago
Any example to do the same in core apis?
Rathrola Prem Kumar6y ago
Great explanation , Keep rocking