Creating Custom Authorization Policy Provider In ASP.NET Core

Here, I have created the requirement for minimum time spent for the organization and created the handler that calculates the of days for an employee by subtracting today's date from claim "DateOfJoing" and if the result is greater than or equal to the supplied data then the user is authorized to access.

Authorization Requirement

using Microsoft.AspNetCore.Authorization;
namespace PolicyBasedAuthorization.Policy
{
    public class MinimumTimeSpendRequirement : IAuthorizationRequirement
    {
        public MinimumTimeSpendRequirement(int noOfDays)
        {
            TimeSpendInDays = noOfDays;
        }
        public int TimeSpendInDays { get; private set; }
    }
}

Authorization handler

using Microsoft.AspNetCore.Authorization;
using System;
using System.Threading.Tasks;
namespace PolicyBasedAuthorization.Policy
{
    public class MinimumTimeSpendHandler : AuthorizationHandler<MinimumTimeSpendRequirement>
    {
        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumTimeSpendRequirement requirement)
        {
            if (!context.User.HasClaim(c => c.Type == "DateOfJoining"))
            {
                return Task.FromResult(0);
            }
            var dateOfJoining = Convert.ToDateTime(context.User.FindFirst(c => c.Type == "DateOfJoining").Value);

            double calculatedTimeSpend = (DateTime.Now.Date - dateOfJoining.Date).TotalDays;
            if (calculatedTimeSpend >= requirement.TimeSpendInDays)
            {
                context.Succeed(requirement);
            }
            return Task.FromResult(0);
        }
    }
}

Step 3. Create a custom policy provider

In this step, we will create the policy by implementing IAuthorizationPolicyProvider. This interface has two abstract methods: GetDefaultPolicyAsync and GetPolicyAsync. In a GetDefaultPolicyAsync method, I will return all the policies that are provided by the default provider. In a GetPolicyAsync method, I will check if the policy name pattern is following a pattern (i.e. MinimumTimeSpend.{input value}) generated in the custom authorize attribute. If the pattern matches, then I will extract the number of days from the policy name and supplied requirement.

using System;
using System.Threading.Tasks;
using ClaimBasedPolicyBasedAuthorization.Policy;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Options;
namespace PolicyBasedAuthorization.Policy
{
    public class MinimumTimeSpendPolicy : IAuthorizationPolicyProvider
    {
        public DefaultAuthorizationPolicyProvider DefaultPolicyProvider { get; }
        public MinimumTimeSpendPolicy(IOptions<AuthorizationOptions> options)
        {
            DefaultPolicyProvider = new DefaultAuthorizationPolicyProvider(options);
        }
        public Task<AuthorizationPolicy> GetDefaultPolicyAsync()
        {
            return DefaultPolicyProvider.GetDefaultPolicyAsync();
        }
        public Task<AuthorizationPolicy> GetPolicyAsync(string policyName)
        {
            string[] subStringPolicy = policyName.Split(new char[] { '.' });
            if (subStringPolicy.Length > 1 &&
                subStringPolicy[0].Equals("MinimumTimeSpend", StringComparison.OrdinalIgnoreCase) &&
                int.TryParse(subStringPolicy[1], out var days))
            {
                var policy = new AuthorizationPolicyBuilder();
                policy.AddRequirements(new MinimumTimeSpendRequirement(days));
                return Task.FromResult(policy.Build());
            }
            return DefaultPolicyProvider.GetPolicyAsync(policyName);
        }
    }
}

Step 4. Register Handler and Policy Provider

The next and final step is to register the authorization handler and policy provider. To use custom policies, we must register an authorization handler that is associated with the requirement used in customs policy and also we need to register a custom policy provider in the ConfigureServices method of the startup class.

public void ConfigureServices(IServiceCollection services)
{
    // Add your service registrations here
    services.AddTransient<IAuthorizationPolicyProvider, MinimumTimeSpendPolicy>();
    services.AddSingleton<IAuthorizationHandler, MinimumTimeSpendHandler>();
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
    services.AddAuthorization();
}

To get the desired result, we need to apply a custom authorized filter to the controller action method. In the following example code, "Method1" can be accessed by the user who completed 365 or more days in a company, "Method2" is accessed by the user who completed 180 or more days in a company and "Method3" is accessed by the user who completed 10 or more days in the company.

public class DemoController : Controller
{
    [MinimumTimeSpendAuthorize(180)]
    public IActionResult TestMethod2()
    {
        return View("MyPage");
    }
    [MinimumTimeSpendAuthorize(365)]
    public IActionResult TestMethod1()
    {
        return View("MyPage");
    }
    [MinimumTimeSpendAuthorize(10)]
    public IActionResult TestMethod3()
    {
        return View("MyPage");
    }
}

Summary

Using the method described in this article, we can create custom authorization policy providers using IAuthorizationPolicyProvider. It is very useful when we have a large range of policies or a policy created based on runtime information.

You can view or download the source code from the GitHub link here.