ASP.NET Core 2.0 Web API 基于 JWT 的自定义策略授权详解

public void ConfigureServices(IServiceCollection services)
{
    // ... 其他服务配置，如 AddMvc() 等
 
    // 1. 配置 JWT 设置，通常从 appsettings.json 中读取
    var jwtSettings = Configuration.GetSection("JwtSettings");
    var secretKey = Encoding.ASCII.GetBytes(jwtSettings.GetValue<string>("SecretKey"));
 
    services.Configure<JwtSettings>(jwtSettings);
 
    // 2. 添加认证服务
    services.AddAuthentication(options =>
    {
        // 设置默认的认证方案为 JWT Bearer
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = false; // 生产环境应为 true
        options.SaveToken = true;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(secretKey), // 使用密钥验证签名
            ValidateIssuer = true,
            ValidIssuer = jwtSettings.GetValue<string>("Issuer"), // 验证签发者
            ValidateAudience = true,
            ValidAudience = jwtSettings.GetValue<string>("Audience"), // 验证接收者
            ValidateLifetime = true, // 验证令牌有效期
            ClockSkew = TimeSpan.Zero // 容忍的时间偏差（零表示不容忍）
        };
    });
 
    // 授权配置将在下一步添加
    services.AddAuthorization();
    
    // ... 其他配置
}
 
// JWT 配置模型
public class JwtSettings
{
    public string SecretKey { get; set; }
    public string Issuer { get; set; }
    public string Audience { get; set; }
    public int ExpireMinutes { get; set; }
}

{
  "JwtSettings": {
    "SecretKey": "ThisIsASuperLongSecretKeyForSigningTheJwtToken!",
    "Issuer": "MyWebApi",
    "Audience": "MyWebApiClients",
    "ExpireMinutes": 60
  }
}

using Microsoft.AspNetCore.Authorization;
 
// 部门要求：要求用户必须属于某个特定部门
public class DepartmentRequirement : IAuthorizationRequirement
{
    public string RequiredDepartment { get; }
 
    public DepartmentRequirement(string requiredDepartment)
    {
        RequiredDepartment = requiredDepartment;
    }
}
 
// 职级要求：要求用户的职级必须达到某个级别
// 假设职级用数字表示，越大级别越高（例如：1-Staff, 2-Manager, 3-Director）
public class MinimumRankRequirement : IAuthorizationRequirement
{
    public int MinimumRank { get; }
 
    public MinimumRankRequirement(int minimumRank)
    {
        MinimumRank = minimumRank;
    }
}

using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;
 
// 处理 DepartmentRequirement
public class DepartmentHandler : AuthorizationHandler<DepartmentRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        DepartmentRequirement requirement)
    {
        // 1. 检查用户是否认证
        if (!context.User.Identity.IsAuthenticated)
        {
            context.Fail();
            return Task.CompletedTask;
        }
 
        // 2. 从用户的声明中查找 "Department" 声明
        var departmentClaim = context.User.Claims
            .FirstOrDefault(c => c.Type == "Department");
 
        // 3. 进行逻辑判断
        if (departmentClaim != null && departmentClaim.Value == requirement.RequiredDepartment)
        {
            // 声明匹配，授权成功
            context.Succeed(requirement);
        }
        else
        {
            // 声明不匹配，授权失败
            context.Fail();
        }
 
        return Task.CompletedTask;
    }
}
 
// 处理 MinimumRankRequirement
public class MinimumRankHandler : AuthorizationHandler<MinimumRankRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumRankRequirement requirement)
    {
        if (!context.User.Identity.IsAuthenticated)
        {
            context.Fail();
            return Task.CompletedTask;
        }
 
        var rankClaim = context.User.Claims.FirstOrDefault(c => c.Type == "Rank");
 
        if (rankClaim != null && int.TryParse(rankClaim.Value, out int userRank))
        {
            // 判断用户职级是否达到最低要求
            if (userRank >= requirement.MinimumRank)
            {
                context.Succeed(requirement);
            }
            else
            {
                context.Fail();
            }
        }
        else
        {
            context.Fail();
        }
 
        return Task.CompletedTask;
    }
}

public void ConfigureServices(IServiceCollection services)
{
    // ... 之前的 JWT 认证配置 ...
 
    services.AddAuthorization(options =>
    {
        // 注册一个名为 "HRDepartment" 的策略，它要求 Department 必须是 "HR"
        options.AddPolicy("HRDepartment", policy =>
            policy.Requirements.Add(new DepartmentRequirement("HR")));
 
        // 注册一个名为 "ITDepartment" 的策略
        options.AddPolicy("ITDepartment", policy =>
            policy.Requirements.Add(new DepartmentRequirement("IT")));
 
        // 注册一个名为 "ManagerOnly" 的策略，要求职级至少为 2 (Manager)
        options.AddPolicy("ManagerOnly", policy =>
            policy.Requirements.Add(new MinimumRankRequirement(2)));
 
        // 组合策略：必须同时属于 IT 部门且是经理
        options.AddPolicy("ITManager", policy =>
        {
            policy.Requirements.Add(new DepartmentRequirement("IT"));
            policy.Requirements.Add(new MinimumRankRequirement(2));
        });
    });
 
    // 将自定义的授权处理程序注册到依赖注入容器中，使其生命周期为 Singleton
    services.AddSingleton<IAuthorizationHandler, DepartmentHandler>();
    services.AddSingleton<IAuthorizationHandler, MinimumRankHandler>();
 
    // ... 其他配置
}

[ApiController]
[Route("api/[controller]")]
[Authorize] // 整个控制器需要认证，但不对策略做要求
public class EmployeesController : ControllerBase
{
    [HttpGet]
    public IActionResult GetAllEmployees()
    {
        // 所有认证用户都可以访问
        return Ok(new { message = "所有员工列表" });
    }
 
    [HttpGet("hr")]
    [Authorize(Policy = "HRDepartment")] // 只有 HR 部门的用户能访问
    public IActionResult GetHrEmployees()
    {
        return Ok(new { message = "HR部门员工列表" });
    }
 
    [HttpDelete("{id}")]
    [Authorize(Policy = "ManagerOnly")] // 只有经理及以上职级的用户能删除
    public IActionResult DeleteEmployee(int id)
    {
        return Ok(new { message = $"已删除员工 {id}" });
    }
 
    [HttpPost("it-bonus")]
    [Authorize(Policy = "ITManager")] // 必须同时满足 IT 部门和经理职级
    public IActionResult AssignItBonus()
    {
        return Ok(new { message = "IT 部门奖金已分配" });
    }
}