How can I do authorization in my scenario

Question

Hey,

my first project with ASP.NET Core Blazor had the authorization managed by roles.
This was all fine, because one person had access to one "company".
In my rework of the app I tried to do, that a user can switch between "companies".
So the problem would be, if a page requires the balance role the user would get the role balance and then would be able to access this site on another "company" as well, even though in this company he shouldn't have access to the page.

I don't know if it would be a practical solution to create this role for every company created.
This would mean the "company" with ID 1 would get the balance_1 role name.
I would create these roles as the "company" gets created, so they can then be assigned to the users.

For example, I'm working on this for a fun project server, and around 40 "companies" with about 20 users each would use this. This would make 800 DB entries for the roles alone. I haven't built anything that "big", so I really can't tell if this is ok or too much.

On the other hand I had a peek into the policy-based authorization, and as far as I could tell there would not be a way to create a policy with a variable parameter to pass to the AuthorizationHandler expansion method.

The currently used "company" by the employee is a URL parameter, and stored in a session based class. If you need this information.

Thanks ahead for your ideas.

DaNeubi

Answer 1

I’d dynamically load the roles on each request, to match the user/company combo for the request. Easy with middleware.