Question

I current have the following attribute decorating one of the action method.

[Authorize(Roles = "Admin")]
public ActionResult DoAdminTask()
{
//Do something

   return View();
}

Currently, only users in the Admin role can invoke this method, but this will change. Is there anyway I can store a list of authorised roles in a config file, rather than hard coding it into the source?

EDIT: Roles will change over time, and more than 1 role will need access. i.e. Users in either role A OR role B can access.

Answer 1

No way to do this with the standard authorize attribute, but you could extend the authorize attribute with your own custom authorize attribute and have it use a configuration file to determine the mapping between controller/action and the set of roles.

Answer 2

but you can use something like

public static class AppRoles
{
    public const string Users = "UsersRoleName";
    public const string Admin = "AdminRoleName";
}

and then Controller can have authorize attribute as

[Authorize(Roles = AppRoles.Admin)]

Answer 3

I felt this question deserved an answer with a code sample... Taking @tvanfosson s suggestion of extending the AuthorizeAttribute class, here s what I came up with (criticism is more than welcome).

AuthorizeFromConfiguration.cs:

public class AuthorizeFromConfiguration: AuthorizeAttribute
{
    public new string Roles
    {
        get {
            return base.Roles;
        }
        set {
            var config = new ConfigurationBuilder()
                .SetBasePath(Environment.CurrentDirectory)
                .AddJsonFile("authorization.json")
                .Build();
            base.Roles = config[value];
        }
    }
}

authorization.json:

{
    "Parts": {
        "Create": "contoso.com\MyWebApp_CreateNewPart",
        "Edit": "contoso.com\MyWebApp_EditPart"
    }
}

Example Usage:

[AuthorizeFromConfiguration(Roles = "Parts:Create")]
public class CreateModel : PageModel
{
    //...
}

Note: In my testing, the web-site had to be restarted before any changes to authorization.json file took effect, even when I tried changing the logic so that the JSON file was read on the get accessor instead of the set.

友情链接