MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore
8.7.5
dotnet add package MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore --version 8.7.5
NuGet\Install-Package MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore -Version 8.7.5
<PackageReference Include="MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore" Version="8.7.5" />
paket add MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore --version 8.7.5
#r "nuget: MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore, 8.7.5"
// Install MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore as a Cake Addin #addin nuget:?package=MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore&version=8.7.5 // Install MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore as a Cake Tool #tool nuget:?package=MadEyeMatt.AspNetCore.Identity.Permissions.EntityFrameworkCore&version=8.7.5
AspNetCore.Authorization.Permissions
A libary that provides permission-based authorization.
The ASP.NET Core role-based authorization in combination with custom authorization policies is a good starting point for restricting users' access in an application, but it is very static and changes to the meaning of a role or a policy forces you to perform changes in your code and to re-deploy your application. This library aims to overcome this limitation.
To be able to dynamically change the access of a user we extend the role in a way that each role is made up of several fine gained permissions. Throughout the documentation and the sample applications we will use the following roles and permissions.
Role | Invoice.Read | Invoice.Write | Invoice.Delete | Invoice.Send | Invoice.Payment |
---|---|---|---|---|---|
Boss | YES | NO | NO | NO | NO |
Manager | YES | NO | YES | NO | NO |
Employee | YES | YES | NO | YES | YES |
In this fictional company the boss can only read invoices, the manager can read and delete invoices and the employees can read, write, send invocies and can trigger the selllement of the invoice.
If we build the authentication around the three role we will hard-code the access permissions in our
codebase f.e. using the [Authorize]
attribute. But if the boss decides he also wants
to be able to delete invoices, we need to change it in the source code.
Using permissions of the role defined in the table above in the [Authorize]
attribute instead
of the roles, we can just change the role configuration in a data store and assign the permision
Invoices.Delete to the role Boss. The boss used is then able to delete invocies without
the need to change the code and re-deploy the application.
The library consists of two parts:
- The base definitions, policies and services to be able to check an authenticated users claims
(i.e.
ClaimsPrincipal
) for asigned permissions. - An implementation of the permissions API to work with ASP.NET Core Identity.
It is possible to add different storages and claims providers. A library that wanst to provide
the permissions claims just needs to implement the IClaimsProvider
interface and the storage
mechanism of course.
In addition to the basic permissions of users, this library provides an optional multi-tenant feature. This feature allows assign tenants to users. The tenant infosmations are then added to the user's claims. Storage systems can then leverage the tenant information to alter queries (Single Database with Tenant Column) or to select connection strings (Tenant per Database).
A tenant may have several roles and the permissions of those roles are added to the user's permission claims. In that way additional permissions can be added to individual claims. The tenant sample applications provide tenants with a distict tenant role assigned which provide the following additional tenant permissions. Each tenant represents a separate company. The roles in this example represent different plans of a SaaS application.
Role | Invoice.Statistics | Invoice.TaxExport |
---|---|---|
Free | NO | NO |
Basic | YES | NO |
Professional | YES | YES |
Using tenants, roles and permissions is a good way to define differnent sets of features, f.e. when creating different plans of a SaaS application.
Permission Usage
To configure the permissions with ASP.NET Identity and the default identity models add the following code to your application startup code. The example uses EF Core and SQLite to store the Identity models.
The users, roles and permissions are added to the storage using the ApplicationDbContext
and EF
Core migrations. The code is omitted in this document, but you can look it up in the samples code.
// Previous service configuration omitted.
builder.Services.AddControllers();
builder.Services.AddRazorPages();
builder.Services.AddAuthorization();
builder.Services.AddPermissionsAuthorization();
builder.Services
.AddAuthentication(IdentityConstants.ApplicationScheme)
.AddIdentityCookies();
builder.Services
.AddDbContext<InvoicesContext>(options =>
{
options.UseSqlite("Filename=permissions.db");
})
.AddPermissionsIdentityCore<IdentityUser, IdentityRole, IdentityPermission>()
.AddDefaultUI()
.AddDefaultTokenProviders()
.AddPermissionClaimsProvider()
.AddUserManager<AspNetUserManager<IdentityUser>>()
.AddRoleManager<AspNetRoleManager<IdentityRole>>()
.AddPermissionManager<AspNetPermissionManager<IdentityPermission>>()
.AddPermissionsEntityFrameworkStores<InvoicesContext>();
// Additional service configuration omitted.
Restrict access based on permissions
There are several ways to rescript access in your application.
- Use the
[RequirePermission]
attribute to restrict access to controller actions. - Use the
HasPermission()
extension method with aClaimsPrincipal
instance. - Use the
HasPermission()
method of aIUserPermissionsService
instance. - Use the
RequirePermission
extension methods for Minimal API endpoints.
To retrict the access to an action methods just add the [Authorize]
attribute with the permission
name as contraint.
// ASP.NET MVC controller action with attribute.
[HttpGet]
[HasPermission("Invoice.Payment")]
public IActionResult Get()
{
return this.Ok();
}
// Razor Pages with attribute.
[HasPermission("Invoices.Read")]
public class InvoicesReadModel : PageModel
{
public void OnGet()
{
}
}
// Razor Pages with extension method.
public class InvoicesReadModel : PageModel
{
public IActionResult OnGet()
{
if(!this.User.HasPermission("Invoice.Read"))
{
if(this.User.IsAuthenticated())
{
return this.Forbid();
}
return this.Challenge();
}
return this.Page();
}
}
// Minimal API with extension method.
app.MapGet("invoices/statistics", (HttpContext context) =>
{
return Results.Ok();
})
.RequirePermission("Invoice.Statistics");
Tenant Usage
// Previous service configuration omitted.
builder.Services.AddControllers();
builder.Services.AddRazorPages();
builder.Services.AddAuthorization();
builder.Services.AddPermissionsAuthorization();
builder.Services
.AddAuthentication(IdentityConstants.ApplicationScheme)
.AddIdentityCookies();
builder.Services
.AddDbContext<InvoicesContext>(options =>
{
options.UseSqlite("Filename=permissions.db");
})
.AddPermissionsIdentityCore<IdentityTenant, IdentityUser, IdentityRole, IdentityPermission>()
.AddDefaultUI()
.AddDefaultTokenProviders()
.AddIdentityClaimsProvider()
.AddDefaultTenantProvider()
.AddTenantManager<AspNetTenantManager<IdentityTenant>>()
.AddUserManager<AspNetTenantUserManager<IdentityTenantUser>>()
.AddRoleManager<AspNetRoleManager<IdentityRole>>()
.AddPermissionManager<AspNetPermissionManager<IdentityPermission>>()
.AddPermissionsEntityFrameworkStores<InvoicesContext>();
// Additional service configuration omitted.
Product | Versions Compatible and additional computed target framework versions. |
---|---|
.NET | net6.0 is compatible. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 is compatible. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. |
-
net6.0
- MadEyeMatt.Extensions.Identity.Permissions.Stores (>= 8.7.5)
- Microsoft.AspNetCore.Identity.EntityFrameworkCore (= 6.0.31)
- Microsoft.EntityFrameworkCore (= 6.0.31)
-
net7.0
- MadEyeMatt.Extensions.Identity.Permissions.Stores (>= 8.7.5)
- Microsoft.AspNetCore.Identity.EntityFrameworkCore (= 7.0.20)
- Microsoft.EntityFrameworkCore (= 7.0.20)
-
net8.0
- MadEyeMatt.Extensions.Identity.Permissions.Stores (>= 8.7.5)
- Microsoft.AspNetCore.Identity.EntityFrameworkCore (>= 8.0.6)
- Microsoft.EntityFrameworkCore (>= 8.0.6)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
Version | Downloads | Last updated |
---|---|---|
8.7.5 | 77 | 7/9/2024 |
8.7.4 | 76 | 6/2/2024 |
8.7.3 | 84 | 5/24/2024 |
8.7.2 | 142 | 4/18/2024 |
8.7.1 | 105 | 3/19/2024 |
8.6.0 | 147 | 1/26/2024 |
8.5.2 | 144 | 1/4/2024 |
8.5.1 | 217 | 11/24/2023 |
8.5.0 | 130 | 11/16/2023 |
8.4.4 | 185 | 7/20/2023 |
8.4.3 | 213 | 4/25/2023 |
8.4.2 | 197 | 4/13/2023 |
8.4.1 | 208 | 4/13/2023 |
8.4.0 | 201 | 4/12/2023 |
8.3.4 | 205 | 4/9/2023 |
8.3.3 | 225 | 4/2/2023 |
8.3.2 | 223 | 4/2/2023 |
8.3.1 | 212 | 4/2/2023 |
8.3.0 | 234 | 3/31/2023 |
8.2.3 | 233 | 3/31/2023 |
8.2.2 | 216 | 3/31/2023 |
8.2.1 | 223 | 3/31/2023 |
8.2.0 | 210 | 3/30/2023 |
8.1.1 | 238 | 3/22/2023 |
8.1.0 | 229 | 3/21/2023 |
8.0.0 | 232 | 3/16/2023 |