IAuthorizationPolicy Interfaz

Definición

Espacio de nombres:

System.IdentityModel.Policy

Ensamblado:

System.ServiceModel.Primitives.dll

Paquete:

System.ServiceModel.Primitives v6.2.0

Source:

IAuthorizationPolicy.cs

Define un conjunto de reglas para autorizar a un usuario, según un conjunto de demandas.

public interface class IAuthorizationPolicy : System::IdentityModel::Policy::IAuthorizationComponent

public interface IAuthorizationPolicy : System.IdentityModel.Policy.IAuthorizationComponent

type IAuthorizationPolicy = interface
    interface IAuthorizationComponent

Public Interface IAuthorizationPolicy
Implements IAuthorizationComponent

Implementaciones

IAuthorizationComponent

Ejemplos

public class MyAuthorizationPolicy : IAuthorizationPolicy
{
    string id;

    public MyAuthorizationPolicy()
    {
        id =  Guid.NewGuid().ToString();
    }

    public bool Evaluate(EvaluationContext evaluationContext, ref object state)
    {
        bool bRet = false;
        CustomAuthState customstate = null;

        // If state is null, then this method has not been called before, so
        // set up a custom state.
        if (state == null)
        {
            customstate = new CustomAuthState();
            state = customstate;
        }
        else
        {
            customstate = (CustomAuthState)state;
        }

        Console.WriteLine("Inside MyAuthorizationPolicy::Evaluate");

        // If claims have not been added yet...
        if (!customstate.ClaimsAdded)
        {
            // Create an empty list of Claims.
            IList<Claim> claims = new List<Claim>();

            // Iterate through each of the claim sets in the evaluation context.
            foreach (ClaimSet cs in evaluationContext.ClaimSets)
                // Look for Name claims in the current claim set.
                foreach (Claim c in cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty))
                    // Get the list of operations the given username is allowed to call.
                    foreach (string s in GetAllowedOpList(c.Resource.ToString()))
                    {
                        // Add claims to the list.
                        claims.Add(new Claim("http://example.org/claims/allowedoperation", s, Rights.PossessProperty));
                        Console.WriteLine("Claim added {0}", s);
                    }

            // Add claims to the evaluation context.
            evaluationContext.AddClaimSet(this, new DefaultClaimSet(this.Issuer,claims));

            // Record that claims have been added.
            customstate.ClaimsAdded = true;

            // Return true, which indicates this need not be called again.
            bRet = true;
        }
        else
        {
            // This point should not be reached, but just in case...
            bRet = true;
        }

        return bRet;
    }
    public ClaimSet Issuer
    {
        get { return ClaimSet.System; }
    }

    public string Id
    {
        get { return id; }
    }

    // This method returns a collection of action strings that indicate the
    // operations that the specified username is allowed to call.
    private IEnumerable<string> GetAllowedOpList(string username)
    {
        IList<string> ret = new List<string>();

        if (username == "test1")
        {
            ret.Add ( "http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add ("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply");
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        else if (username == "test2")
        {
            ret.Add ( "http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add ("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        return ret;
    }

    // internal class for state
    class CustomAuthState
    {
        bool bClaimsAdded;

        public CustomAuthState()
        {
            bClaimsAdded = false;
        }

        public bool ClaimsAdded { get { return bClaimsAdded; }
                                  set {  bClaimsAdded = value; } }
    }
}

Public Class MyAuthorizationPolicy
    Implements IAuthorizationPolicy
    Private value_id As String


    Public Sub New()
        value_id = Guid.NewGuid().ToString()

    End Sub 

    Public Function Evaluate(ByVal evaluationContext As EvaluationContext, _
         ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate

        Dim bRet As Boolean = False
        Dim customstate As CustomAuthState = Nothing

        ' If state is null, then this method has not been called before, so 
        ' set up a custom state.
        If state Is Nothing Then
            customstate = New CustomAuthState()
            state = customstate
        Else
            customstate = CType(state, CustomAuthState)
        End If
        Console.WriteLine("Inside MyAuthorizationPolicy::Evaluate")

        ' If the claims have not been added yet...
        If Not customstate.ClaimsAdded Then
            ' Create an empty list of Claims
            Dim claims As New List(Of Claim)

            ' Iterate through each of the claimsets in the evaluation context.
            Dim cs As ClaimSet
            For Each cs In evaluationContext.ClaimSets
                ' Look for Name claims in the current claim set.
                Dim c As Claim
                For Each c In cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty)
                    ' Get the list of operations the given username is allowed to call.
                    Dim s As String
                    For Each s In GetAllowedOpList(c.Resource.ToString())

                        ' Add claims to the list
                        claims.Add(New Claim("http://example.org/claims/allowedoperation", _
                                    s, Rights.PossessProperty))
                        Console.WriteLine("Claim added {0}", s)
                    Next s
                Next c
            Next cs 
            
            ' Add claims to the evaluation context.
            evaluationContext.AddClaimSet(Me, New DefaultClaimSet(Me.Issuer, claims))

            ' Record that claims have been added.
            customstate.ClaimsAdded = True

            ' Return true, which indicates the method need not to be called again.
            bRet = True
        Else
            ' Should never get here, but just in case...
            bRet = True
        End If


        Return bRet

    End Function 'Evaluate

    Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer

        Get
            Return ClaimSet.System
        End Get
    End Property

    Public ReadOnly Property Id() As String Implements IAuthorizationPolicy.Id

        Get
            Return value_id
        End Get
    End Property
    ' This method returns a collection of action strings that indicate the 
    ' operations that the specified username is allowed to call.
    Private Shared Function GetAllowedOpList(ByVal username As String) As IEnumerable(Of String)


        Dim ret As New List(Of String)

        If username = "test1" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        ElseIf username = "test2" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        End If
        Return ret

    End Function 

    ' This is an internal class for state.
    Class CustomAuthState
        Private bClaimsAdded As Boolean


        Public Sub New()

        End Sub 


        Public Property ClaimsAdded() As Boolean
            Get
                Return bClaimsAdded
            End Get
            Set(ByVal value As Boolean)
                bClaimsAdded = value
            End Set
        End Property
    End Class 
End Class

Comentarios

Implemente la interfaz IAuthorizationPolicy para agregar o asignar un conjunto de demandas a otro. Una directiva de autorización examina un conjunto de demandas y agrega demandas adicionales según el conjunto actual. Por ejemplo, una directiva de autorización podría evaluar una demanda que contenga la fecha de nacimiento y agregar una demanda que valide que el usuario es mayor de 21 años y agregar una demanda de edad superior a 21 a la EvaluationContext.

Las clases que implementan la interfaz IAuthorizationPolicy no autorizan a los usuarios, pero sí se lo permiten a la clase ServiceAuthorizationManager. ServiceAuthorizationManager llama al método Evaluate para cada directiva de autorización. El método Evaluate determina si las demandas adicionales se deberían agregar para el usuario, según el contexto actual. Se puede llamar al método Evaluate de una directiva de autorización varias veces, cuando las demandas se agregan a EvaluationContext a través de otras directivas de autorización. Cuando se realizan todas las directivas de autorización, la clase ServiceAuthorizationManager toma decisiones de autorización basadas en el conjunto final de demandas. La clase ServiceAuthorizationManager crea a continuación una AuthorizationContext que contiene un conjunto inmutable de demandas que refleja estas decisiones de autorización.

Propiedades

Id	Obtiene una cadena que identifica este componente de autorización. (Heredado de IAuthorizationComponent)
Issuer	Obtiene un conjunto de demandas que representa al emisor de la directiva de autorización.

Métodos

Evaluate(EvaluationContext, Object)

Evalúa si un usuario cumple los requisitos para esta directiva de autorización.

Consulte también

• Ejemplo de directiva de autorización