Blazor WASM授权不适用于AAD角色

Question

我正在尝试根据此文档后面的用户定义角色设置AAD授权https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/azure-active-directory-groups-and-roles?view=aspnetcore-3.1#用户定义的角色我可以在应用程序清单中设置它，并使API授权工作。然而，当我尝试在UI端进行操作时，我无法显示声明。我做了json解释类(DirectoryObjects、CustomUserAccount和Value(由目录对象使用((。我还添加了CustomUserFactory，删除了组内容，因为我只关心角色：

private readonly ILogger<CustomUserFactory> _logger;
private readonly IHttpClientFactory _clientFactory;
public CustomUserFactory(IAccessTokenProviderAccessor accessor,
IHttpClientFactory clientFactory,
ILogger<CustomUserFactory> logger)
: base(accessor)
{
_clientFactory = clientFactory;
_logger = logger;
}
public async override ValueTask<ClaimsPrincipal> CreateUserAsync(
CustomUserAccount account,
RemoteAuthenticationUserOptions options)
{
var initialUser = await base.CreateUserAsync(account, options);
if (initialUser.Identity.IsAuthenticated)
{
var userIdentity = (ClaimsIdentity)initialUser.Identity;
foreach (var role in account.Roles)
{
userIdentity.AddClaim(new Claim("role", role));
}

}
return initialUser;
}

然后我修改了文件中提到的.cs程序：

builder.Services.AddMsalAuthentication<RemoteAuthenticationState,
CustomUserAccount>(options =>
{
builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
options.ProviderOptions.DefaultAccessTokenScopes.Add("apiaccessguid");
options.UserOptions.RoleClaim = "role";
}).AddAccountClaimsPrincipalFactory<RemoteAuthenticationState, CustomUserAccount,
CustomUserFactory>();

当这不起作用时，我尝试将其添加为一项政策，但也没有成功：

builder.Services.AddAuthorizationCore(options =>
{
options.AddPolicy("Admin", policy =>
policy.RequireClaim("role", "admin"));
});

用于限制我在带有user.IsInRole("admin")的代码和带有的UI中尝试的视图

<AuthorizeView Roles="admin">
<li class="nav-item px-3">
<NavLink class="nav-link" href="Admin">
Admin
</NavLink>
</li>
</AuthorizeView>

以及政策：

<AuthorizeView Policy="Admin">
<Authorized>
<p>
The user is in the 'Administrator' AAD Administrative Role
and can see this content.
</p>
</Authorized>
<NotAuthorized>
<p>
The user is NOT in the 'Administrator' role and sees this
content.
</p>
</NotAuthorized>
</AuthorizeView>

他们都不起作用。我有什么东西不见了吗？我还验证了令牌是否具有管理员角色。

Answer 1

我通过在策略选项中使用RequireRole使其工作。

例如，我将应用程序角色添加到清单中：

"appRoles": [
{
"allowedMemberTypes": [
"User"
],
"description": "Reader role.",
"displayName": "Reader",
"id": "41d9ba42-456e-4471-8946-24216e5f6c64",
"isEnabled": true,
"lang": null,
"origin": "Application",
"value": "Reader"
}
]

通过RequireRole:配置策略

builder.Services.AddAuthorizationCore(options =>
{
options.AddPolicy("app-reader", policy => policy.RequireRole("Reader"));
});

然后按照使用

<AuthorizeView Policy="app-reader">
<Authorized>
<p>
The user is in the 'Reader' Role
and can see this content.
</p>
</Authorized>
<NotAuthorized>
<p>
The user is NOT in the 'Reader' role 
and sees this content.
</p>
</NotAuthorized>
</AuthorizeView>

或者，作为剃刀页面上的属性：

@attribute [Authorize(Policy = "app-reader")]

Answer 2

发现我的问题，代码很好，问题出在Azure注册端，客户端使用Azure中客户端应用程序中注册的角色，而服务器使用服务器应用程序中的角色。因此，请确保使用相同的角色在两者中注册用户。