Role Base Authorization In ASP.NET Core 2.1

Introduction

 

Authorization is a process that determines what a user is able to do. For example, an Admin user is allowed to install/remove a software from a computer and a non-Admin user can use the software from the computer. It is independent and orthogonal from authentication. However, authorization requires an authentication mechanism. For applications, the first step is always authentication and then authorization.

 

Identity is membership system that allows us to add login functionality to our application and identity may belong to one or more roles. For Example, "User1" belongs to "Admin" role and "User2" belongs to "HR" role.

 

Using AuthorizeFilter, we can control the access in our MVC/Web API application by specifying this attribute in controller or action method. Role based authorization checks whether login user role has access to the page or not. Here developer embeds the roles with their code.

 

To demostrate with an example, I have created 3 roles and 3 users and mapped user with roles. I have achieved this by using the following code.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, IServiceProvider serviceProvider)
{
    ....
    ....
    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "{controller=Home}/{action=Index}/{id?}");
    });

    CreateRoles(serviceProvider).Wait();
}

private async Task CreateRoles(IServiceProvider serviceProvider)
{
    //initializing custom roles
    var RoleManager = serviceProvider.GetRequiredService<RoleManager<IdentityRole>>();
    var UserManager = serviceProvider.GetRequiredService<UserManager<IdentityUser>>();
    string[] roleNames = { "Admin", "User", "HR" };
    IdentityResult roleResult;

    foreach (var roleName in roleNames)
    {
        var roleExist = await RoleManager.RoleExistsAsync(roleName);
        if (!roleExist)
        {
            //create the roles and seed them to the database: Question 1
            roleResult = await RoleManager.CreateAsync(new IdentityRole(roleName));
        }
    }

    IdentityUser user = await UserManager.FindByEmailAsync("[email protected]");

    if (user == null)
    {
        user = new IdentityUser()
        {
            UserName = "[email protected]",
            Email = "[email protected]",
        };
        await UserManager.CreateAsync(user, "Test@123");
    }
    await UserManager.AddToRoleAsync(user, "Admin");


    IdentityUser user1 = await UserManager.FindByEmailAsync("[email protected]");

    if (user1 == null)
    {
        user1 = new IdentityUser()
        {
            UserName = "[email protected]",
            Email = "[email protected]",
        };
        await UserManager.CreateAsync(user1, "Test@123");
    }
    await UserManager.AddToRoleAsync(user1, "User");

    IdentityUser user2 = await UserManager.FindByEmailAsync("[email protected]");

    if (user2 == null)
    {
        user2 = new IdentityUser()
        {
            UserName = "[email protected]",
            Email = "[email protected]",
        };
        await UserManager.CreateAsync(user2, "Test@123");
    }
    await UserManager.AddToRoleAsync(user2, "HR");

}

 

 

We can specify the roles that have access to the requested resource using the Roles property of Authorize attribute. For example, the following code allows us to access the action method to users who are member of "Admin" role.

[Authorize(Roles = "Admin")]
public IActionResult OnlyAdminAccess()
{
    ViewData["role"] = "Admin";
    return View("MyPage");
}

We can specify multiple roles as a comma separated list. For example, in the following code snippet, action method would be only accessible by users who are members of either "Admin" or "User".

[Authorize(Roles = "Admin,User")]
public IActionResult MultipleAccess()
{
    ViewData["role"] = "Admin";
    return View("MyPage");
}

We can also apply multiple Authorize attributes and specify the role that has access.

[Authorize(Roles = "Admin")]
[Authorize(Roles = "User")]
public IActionResult MultipleAccess()
{
    ViewData["role"] = "Admin";
    return View("MyPage");
}

Policy based role checks

 

We can also create new policy that expresses the role requirement. We can add & register policy using the authorization service configuration. In the following code snippet, I have created the policy that allows access only to users who are members of "Admin".

public void ConfigureServices(IServiceCollection services)
{
....
....
services.AddAuthorization(options =>
   {
       options.AddPolicy("OnlyAdminAccess", policy => policy.RequireRole("Admin"));
   });
}

We can apply the policy to AuthorizeAttribute using "Policy" property.

[Authorize(Policy = "OnlyAdminAccess")]
public IActionResult PolicyExample()
{
    ViewData["role"] = "Admin";
    return View("MyPage");
}

Using this policy method, we can also do role based authorization for Razor pages. For example, if I have Razor page "Test1.cshtml" and this page can only be accessed by the user having "Admin" role, the following code helps us to add authorization for this Razor page.

public void ConfigureServices(IServiceCollection services)
{
    ...
    ...
    services.AddMvc().AddRazorPagesOptions(options =>
    {
        options.Conventions.AuthorizePage("/test1", "OnlyAdminAccess");


    }).SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

    services.AddAuthorization(options =>
    {
        options.AddPolicy("OnlyAdminAccess", policy => policy.RequireRole("Admin"));
    });
}

You can view or download the source code from the GitHub link here.