c# - .net 5 how to setup authorization using custom provider

Question

in my .net 5 website i have to read user login from header and the call external webservice to check if is authorized and get permission list.

I'using custom attribute to manage this scenario in this way:

public class MyAuthenticationAttribute : ActionFilterAttribute, IAuthenticationFilter{
    public string[] Roles { get; set; }
    public void OnAuthentication(AuthenticationContext filterContext)
      {
        string MyHeaderToken = “SM_USER”;

        string userSSO = null;
        if (HttpContext.Current.Request.Headers[MyHeaderToken] != null)
        {
             userSSO = HttpContext.Current.Request.Headers[MyHeaderToken];
                Trace.WriteLine(string.Format(“got MyToken: {0}”, userSSO));
        }
        if (string.IsNullOrWhiteSpace(userSSO))
        {
                Trace.WriteLine(“access denied, no token found”);
        }
        else
        {
        // Create GenericPrincipal
        GenericIdentity webIdentity = new GenericIdentity(userSSO, “My”);
        string[] methods= GetMethods(userSSO);
        GenericPrincipal principal = new GenericPrincipal(webIdentity, methods);
        filterContext.HttpContext.User = principal; 
        }
    }
    public void OnAuthenticationChallenge(AuthenticationChallengeContext filterContext)
    {
        //check authorizations
    }
}

but external webservice returns list of controller/action authorized for users, so i have to test all actions executions to simply check if names is contained in the list.

is there a way to do this without have to write attribute on every actions or every controllers in this way:

[MyAuthentication(Roles = “Admin”)]
pubic class AdminController: Controller
{
}

i know i can use

services.AddMvc(o =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    o.Filters.Add(new AuthorizeFilter(policy));
});

but no idea of how to use this with my custom authorization

i'am also not sure if string[] methods= GetMethods(userSSO) is cached by .net core filterContext.HttpContext.User avoiding multiple calls to external webservice.

Thanks

question from:https://stackoverflow.com/questions/65858115/net-5-how-to-setup-authorization-using-custom-provider

Answer 1

Waitting for answers