Improving WIF’s Claims-based Authorization - Part 1
- by Your DisplayName here!
As mentioned in my last post,
I made several additions to WIF’s built-in authorization infrastructure to make it
more flexible and easy to use.
The foundation for all this work is that you have to be able to directly call the
registered ClaimsAuthorizationManager. The following snippet is the universal
way to get to the WIF configuration that is currently in effect:
public static ServiceConfiguration ServiceConfiguration
{
get
{
if (OperationContext.Current
== null)
{
//
no WCF
return FederatedAuthentication.ServiceConfiguration;
}
//
search message property
if (OperationContext.Current.IncomingMessageProperties.
ContainsKey("ServiceConfiguration"))
{
var configuration
= OperationContext.Current.
IncomingMessageProperties["ServiceConfiguration"] as ServiceConfiguration;
if (configuration
!= null)
{
return configuration;
}
}
//
return configuration from configuration file
return new ServiceConfiguration();
}
}
From here you can grab ServiceConfiguration.ClaimsAuthoriationManager which
give you direct access to the CheckAccess method (and thus control over claim
types and values).
I then created the following wrapper methods:
public static bool CheckAccess(string resource, string action)
{
return CheckAccess(resource,
action, Thread.CurrentPrincipal as IClaimsPrincipal);
}
public static bool CheckAccess(string resource, string action, IClaimsPrincipal principal)
{
var context
= new AuthorizationContext(principal,
resource, action);
return AuthorizationManager.CheckAccess(context);
}
public static bool CheckAccess(Collection<Claim>
actions, Collection<Claim>
resources)
{
return CheckAccess(new AuthorizationContext(
Thread.CurrentPrincipal.AsClaimsPrincipal(),
resources, actions));
}
public static bool CheckAccess(AuthorizationContext context)
{
return AuthorizationManager.CheckAccess(context);
}
I also created the same set of methods but called DemandAccess. They internally
use CheckAccess and will throw a SecurityException when false is
returned.
All the code is part of Thinktecture.IdentityModel on
Codeplex – or via NuGet (Install-Package Thinktecture.IdentityModel).
