Tingle.AspNetCore.Authorization
4.14.1
dotnet add package Tingle.AspNetCore.Authorization --version 4.14.1
NuGet\Install-Package Tingle.AspNetCore.Authorization -Version 4.14.1
<PackageReference Include="Tingle.AspNetCore.Authorization" Version="4.14.1" />
paket add Tingle.AspNetCore.Authorization --version 4.14.1
#r "nuget: Tingle.AspNetCore.Authorization, 4.14.1"
// Install Tingle.AspNetCore.Authorization as a Cake Addin #addin nuget:?package=Tingle.AspNetCore.Authorization&version=4.14.1 // Install Tingle.AspNetCore.Authorization as a Cake Tool #tool nuget:?package=Tingle.AspNetCore.Authorization&version=4.14.1
Tingle.AspNetCore.Authorization
Authorization refers to the process that determines what a user is able to do. For example, an administrative user is allowed to create a document library, add documents, edit documents, and delete them. A non-administrative user working with the library is only authorized to read the documents.
Authorization is orthogonal and independent of authentication. However, authorization requires an authentication mechanism. Authentication is the process of ascertaining who a user is. Authentication may create one or more identities for the current user.
Below are some of the functionalities that the library provides to aid with authorization work flows.
IP Address Based Authorization
User Defined IPs
It is a common scenario whereby we may require to only allow HTTP requests from certain IPs.
In appsettings.json ...
{
"AllowedNetworks": [
"::1/128",
"127.0.0.1/32"
]
}
In Program.cs ...
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("my_auth_policy", policy =>
{
policy.AddAuthenticationSchemes("my_auth_scheme")
.RequireAuthenticatedUser()
.RequireApprovedNetworks(Configuration.GetSection("AllowedNetworks"));
});
});
// add accessor for HttpContext i.e. implementation of IHttpContextAccessor
builder.Services.AddHttpContextAccessor();
// add IAuthorizationHandler for approved networks
builder.Services.AddApprovedNetworksHandler();
Details of the implementation of my_auth_scheme
authentication scheme have been omitted here since it is beyond the scope of this discussion. More details on how to handle authentication in ASP.NET Core can be found here.
The above code section defines my_auth_policy
authorization policy which ensures the user who has been authenticated via the my_auth_scheme
has access to the resource they're trying to gain access to. Using RequireApprovedNetworks
extension method on the AuthorizationPolicyBuilder
we can then add a comma separated list of IP networks that are approved to access the resource from.
We also have added a call to the services.AddHttpContextAccessor()
extension method in order to allow us to gain access to the HttpContext
which contains the details of the IP address that the request is originating from.
Finally, we have a call to the services.AddApprovedNetworksHandler()
which adds an instance of the ApprovedIPNetworkHandler
. This authorization handler then makes a decision if authorization is allowed by checking if the request IP is among the networks provided in the authorization policy.
Now, we can use this functionality to authorize access to a controller as shown below:
[Authorize("my_auth_policy")]
public class DummyController : ControllerBase
{
...
}
Is that it?... Wait there's more!
Fully Qualified Domain Names
Alternatively, you can provide a list of fully qualified domain names and each of them will be resolved to the list of IP addresses. Let us see how to do this with an example:
In appsettings.json ...
{
"AllowedDomains": ["contoso.com", "northwind.com"]
}
In Program.cs ...
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("my_auth_policy", policy =>
{
policy.AddAuthenticationSchemes("my_auth_scheme")
.RequireAuthenticatedUser()
.RequireNetworkFromDns(Configuration.GetSection("AllowedDomains"));
});
});
// add accessor for HttpContext i.e. implementation of IHttpContextAccessor
builder.Services.AddHttpContextAccessor();
// add IAuthorizationHandler for approved networks
builder.Services.AddApprovedNetworksHandler();
Azure IPs
For developers who are working with Microsoft Azure, and they'd wish to allow all their IP addresses they can do that easily as demonstrated below:
In Program.cs
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("my_auth_policy", policy =>
{
policy.AddAuthenticationSchemes("my_auth_scheme")
.RequireAuthenticatedUser()
.RequireAzureIPNetworks();
});
});
// add accessor for HttpContext i.e. implementation of IHttpContextAccessor
builder.Services.AddHttpContextAccessor();
// add IAuthorizationHandler for approved networks
builder.Services.AddApprovedNetworksHandler();
If you however do not wish to allow the entire range of Azure IPs in a given cloud, you can provide service
and region
parameters to RequireAzureIPNetworks
to scope the range of IPs based on the Azure service and/or region. For example:
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("my_auth_policy", policy =>
{
policy.AddAuthenticationSchemes("my_auth_scheme")
.RequireAuthenticatedUser()
.RequireAzureIPNetworks(cloud: AzureCloud.Public, service: "AzureAppService", region: "westeurope");
});
});
// add accessor for HttpContext i.e. implementation of IHttpContextAccessor
builder.Services.AddHttpContextAccessor();
// add IAuthorizationHandler for approved networks
builder.Services.AddApprovedNetworksHandler();
Product | Versions Compatible and additional computed target framework versions. |
---|---|
.NET | net6.0 is compatible. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 is compatible. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. |
-
net6.0
- AzureIPNetworks (>= 1.9.6)
-
net7.0
- AzureIPNetworks (>= 1.9.6)
-
net8.0
- AzureIPNetworks (>= 1.9.6)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
Version | Downloads | Last updated |
---|---|---|
4.14.1 | 116 | 10/14/2024 |
4.14.0 | 161 | 9/16/2024 |
4.13.0 | 254 | 8/13/2024 |
4.12.0 | 132 | 8/7/2024 |
4.11.2 | 161 | 7/15/2024 |
4.11.1 | 177 | 6/26/2024 |
4.11.0 | 176 | 6/6/2024 |
4.10.1 | 100 | 6/5/2024 |
4.10.0 | 128 | 5/27/2024 |
4.9.0 | 197 | 5/16/2024 |
4.8.0 | 223 | 5/5/2024 |
4.7.0 | 254 | 3/25/2024 |
4.6.0 | 198 | 3/8/2024 |
4.5.0 | 796 | 11/22/2023 |
4.4.1 | 172 | 11/20/2023 |
4.4.0 | 166 | 11/15/2023 |
4.3.0 | 287 | 10/18/2023 |
4.2.2 | 295 | 9/20/2023 |
4.2.1 | 502 | 8/4/2023 |
4.2.0 | 618 | 5/31/2023 |
4.1.1 | 171 | 5/26/2023 |
4.1.0 | 190 | 5/22/2023 |
4.0.0 | 722 | 3/14/2023 |
2.5.0 | 1,001 | 11/21/2022 |
2.4.2 | 2,044 | 7/25/2022 |
2.4.1 | 2,381 | 3/22/2022 |
2.4.0 | 1,993 | 11/10/2021 |
2.3.1 | 1,610 | 9/20/2021 |
2.3.0 | 937 | 7/22/2021 |