具有角色的 JWT 令牌。ASP.NET Core & AngularJS

Question

我有JWT令牌的工作示例。这很好，当我将这个令牌放入AngularJS中时，我可以使用属性[授权]转到API控制器。但是，当我发挥作用时，我不能转到属性[授权（角色=" admin"）]。据我所知，我可以在代币中扮演角色，我需要将请求的标题更改为API。我的代码下面

 public class AuthOptions
{
public const string ISSUER = "MyAuthServer"; 
public const string AUDIENCE = "http://localhost:51489/"; 
const string KEY = "mysupersecret_secretkey!123";   
public const int LIFETIME = 60; 
public static SymmetricSecurityKey GetSymmetricSecurityKey()
{
    return new SymmetricSecurityKey(Encoding.ASCII.GetBytes(KEY));
}
}
[HttpPost]
[AllowAnonymous]
[Route("login")]
public async Task Login([FromBody]LoginViewModel model)
{
    var identity = await GetIdentity(model.Email, model.Password);
    if (identity == null)
    {
        Response.StatusCode = 400;
        await Response.WriteAsync("Invalid username or password.");
        return;
    }
    var now = DateTime.UtcNow;
    var jwt = new JwtSecurityToken(
            issuer: AuthOptions.ISSUER,
            audience: AuthOptions.AUDIENCE,
            notBefore: now,
            claims: identity.Claims,
            expires: now.Add(TimeSpan.FromMinutes(AuthOptions.LIFETIME)),
            signingCredentials: new 
     SigningCredentials(AuthOptions.GetSymmetricSecurityKey(), 
 SecurityAlgorithms.HmacSha256));
    var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);
    var response = new
    {
        access_token = encodedJwt,
        username = identity.Name,
    };

    Response.ContentType = "application/json";
    await Response.WriteAsync(JsonConvert.SerializeObject(response, new 
JsonSerializerSettings { Formatting = Formatting.Indented }));
    return;
}
 private async Task<ClaimsIdentity> GetIdentity(string username, string 
 password)
{
    var user = _db.User.FirstOrDefault(x => x.Email == username);
    if (user != null)
    {
        var checkPass = _userManager.CheckPasswordAsync(user, password);
        if (!checkPass.Result)
            return null;
        var userRoles = await _userManager.GetRolesAsync(user);
        string role = userRoles[0];
        var claims = new List<Claim>
        {
            new Claim(ClaimsIdentity.DefaultNameClaimType, user.Email),
            new Claim(ClaimsIdentity.DefaultRoleClaimType, role)
        };
        ClaimsIdentity claimsIdentity =
        new ClaimsIdentity(claims, "Token", ClaimsIdentity.DefaultNameClaimType,
            ClaimsIdentity.DefaultRoleClaimType);
        return claimsIdentity;
    }

    return null;
}

启动

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.RequireHttpsMetadata = false;
                options.TokenValidationParameters = 
                newTokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = AuthOptions.ISSUER,

                    ValidateAudience = true,
                    ValidAudience = AuthOptions.AUDIENCE,
                    ValidateLifetime = true,

                    IssuerSigningKey =AuthOptions.GetSymmetricSecurityKey(),
                    ValidateIssuerSigningKey = true,
                };
            });

用angularjs $ cookie

进行存储

$http.defaults.headers.common['Authorization'] = 'Bearer ' + 
response.data.access_token;

随着这个侵犯的工作

[Authorize]

使用此侵犯不起作用

[Authorize(Roles = "Admin")]

Answer 1

您将角色存储在令牌中。

您将需要创建一项策略，以使您分配给令牌的角色声明。

在您的Startup.cs

中创建策略

services.AddAuthorization(options =>
{
    options.AddPolicy("Admin", policy => policy.RequireClaim("Role", "Admin"));
});

然后您可以使用此授权属性[Authorize(Policy = "Admin")]