How does claim based authorization work?
How are the claims sent and validated on a backend in web api? And anyone have an example of creating tables to support this type of authorization?
7 comments · 72% upvoted · other discussions
comments
pavle_R
wazzamatazz
It depends on what sort of authentication you're using. If you're using Windows authentication, a set of claims describing the user and their Windows group memberships are loaded when IIS signs the user in. If you're using e.g. a JWT, the token you are issued by the authentication provider will contain various claims that your app will extract from the token and assign to the ClaimsIdentity for the request. You can also add any custom claims you want to the user on the server side. A JWT will for example include a claim that allows you to uniquely identify the calling user, so you could e.g. query a database to retrieve additional claims to sign to the user when they make a call to your API.
NetFutility [OP]
Is there an simple way to tell an API controller to say if the user has a validated token and claims to access X data then authorize them? I know there was a way with attributes when it comes to role based auth. Would I need to create custom attributes?
wazzamatazz
If you're using JWTs, then the JWT middleware takes care of validating the token. When it comes to the authorisation on the controller, you have a few options:
If your controller or method has a plain [Authorize] attribute on it, any authenticated caller can invoke it. You could add code to the method to look at the calling user and check if they have the correct claims.
You can create a subclass of the AuthorizeAttribute, put your custom authorisation logic in there, and then decorate your controller (or specific controller methods) with your new attribute.
If you're using ASP.NET Core, you could use authorisation policies. In your Startup file, you can register any number of custom authorisation policies (e.g. "My policy" = user must have claim X). The [Authorize] attribute gives you the option of specifying a policy name instead of a role name e.g. [Authorize(Policy = "My policy")]. This option is not available in regular ASP.NET.
http://jasonwatmore.com/post/2018/08/14/aspnet-core-21-jwt-authentication-tutorial-with-example-api
Check this out,its pretty impressive HOW-TO for API with jwt +ASP.Core
It helped me land a job and get upper hand on rest of juniors in my firm!
Its pretty much a template project.
I didnt write it nor do I know the dude that did it, but boi oh boi do I owe him much.
Might not fit your needs but its a valuable bookmark,and pretty nice intro to JWT and its integration.
GitPushOrigin-Delete 4 points · Mar 2019
his react tutorial for consuming a jwt token was sooo good! I wish there was more real-world enterprise open source examples
pavle_R 3 points · Mar 2019
TBH dude pretty much chewed up whole fullstack job and spat it out so nicely for us starters.
You get the whole back end start kit and how to consume in every major front end framework.
Dude is the hero non of us deserve.
Just pull his repos,choose your framework and follow the article. There's no way you wont pick up stuff super fast and easy.
Really magnificent HOW-TO,if I dare to say,the best one I found so far.
You get everything written and explained + examples that are easy to follow and understand.
NetFutility [OP] 1 points · Mar 2019
Thanks! This seems like a really good resource. I want to use jwt for authentication and I know you can transfer user claims in the token but I don't know what to do with those claims afterwards. I'm still pretty noob in that aspect of web development.
I want to build an auth api just for giving tokens as like a single sign on endpoint so the users can access all the other APIs I could offer.