我正在尝试为 ASP.NET Web API 创建自定义身份验证过滤器。下面是我的身份验证过滤器的代码
public class IDPAuthenticationFilter : AuthorizationFilterAttribute
{
public override void OnAuthorization(HttpActionContext actionContext)
{
var identity = new ClaimsIdentity();
identity.AddClaim(new Claim(ClaimTypes.Name, "testUser"));
identity.AddClaim(new Claim(ClaimTypes.Role, "client"));
identity.AddClaim(new Claim("testUser"));
identity.AddClaim(new Claim("APP:USERID", "50123"));
var principal = new GenericPrincipal(identity, new string[] { });
Thread.CurrentPrincipal = principal;
HttpContext.Current.User = principal;
base.OnAuthorization(actionContext);
}
}
我已经全局配置了身份验证过滤器,并使用断点确认正在调用过滤器。
config.Filters.Add(new IDPAuthenticationFilter());
问题是如果我[System.Web.Http.Authorize]
属性添加到任何控制器,则会收到 401 未经授权的错误。我能够在控制器操作中使用User.Identity.Name
访问用户名,但是如果我添加授权属性,则会出现错误。我有什么遗漏吗?
谢谢你的时间。如果需要任何其他信息,请添加评论。
有几件事我做错了。首先,我需要实现IAuthenticationFilter
而不是AuthorizationFilterAttribute
其次,我设置身份的方式不正确。下面是对我有用的代码。
public class IDPAuthenticationFilter : Attribute, IAuthenticationFilter
{
public bool AllowMultiple => false;
public async Task AuthenticateAsync (HttpAuthenticationContext context, CancellationToken cancellationToken)
{
HttpRequestMessage request = context.Request;
AuthenticationHeaderValue authorization = request.Headers.Authorization;
if (authorization == null) {
return;
}
if (authorization.Scheme != "Bearer") {
return;
}
var claims = new List<Claim> ();
claims.Add (new Claim (ClaimTypes.Name, "testUser"));
claims.Add (new Claim (ClaimTypes.Role, "client"));
claims.Add (new Claim ("sub", "testUser"));
claims.Add (new Claim("APP:USERID", "50123"));
var identity = new ClaimsIdentity (claims, "Auth_Key");
var principal = new ClaimsPrincipal (new [] { identity });
context.Principal = principal;
HttpContext.Current.User = context.Principal;
Thread.CurrentPrincipal = context.Principal;
}
}