IAuthorizationPolicy 인터페이스

정의

네임스페이스:

System.IdentityModel.Policy

어셈블리:

System.ServiceModel.Primitives.dll

패키지:

System.ServiceModel.Primitives v6.2.0

Source:

IAuthorizationPolicy.cs

클레임 집합이 주어지는 경우 사용자에게 권한을 부여하기 위한 규칙 집합을 정의합니다.

public interface class IAuthorizationPolicy : System::IdentityModel::Policy::IAuthorizationComponent

public interface IAuthorizationPolicy : System.IdentityModel.Policy.IAuthorizationComponent

type IAuthorizationPolicy = interface
    interface IAuthorizationComponent

Public Interface IAuthorizationPolicy
Implements IAuthorizationComponent

구현

IAuthorizationComponent

예제

public class MyAuthorizationPolicy : IAuthorizationPolicy
{
    string id;

    public MyAuthorizationPolicy()
    {
        id =  Guid.NewGuid().ToString();
    }

    public bool Evaluate(EvaluationContext evaluationContext, ref object state)
    {
        bool bRet = false;
        CustomAuthState customstate = null;

        // If state is null, then this method has not been called before, so
        // set up a custom state.
        if (state == null)
        {
            customstate = new CustomAuthState();
            state = customstate;
        }
        else
        {
            customstate = (CustomAuthState)state;
        }

        Console.WriteLine("Inside MyAuthorizationPolicy::Evaluate");

        // If claims have not been added yet...
        if (!customstate.ClaimsAdded)
        {
            // Create an empty list of Claims.
            IList<Claim> claims = new List<Claim>();

            // Iterate through each of the claim sets in the evaluation context.
            foreach (ClaimSet cs in evaluationContext.ClaimSets)
                // Look for Name claims in the current claim set.
                foreach (Claim c in cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty))
                    // Get the list of operations the given username is allowed to call.
                    foreach (string s in GetAllowedOpList(c.Resource.ToString()))
                    {
                        // Add claims to the list.
                        claims.Add(new Claim("http://example.org/claims/allowedoperation", s, Rights.PossessProperty));
                        Console.WriteLine("Claim added {0}", s);
                    }

            // Add claims to the evaluation context.
            evaluationContext.AddClaimSet(this, new DefaultClaimSet(this.Issuer,claims));

            // Record that claims have been added.
            customstate.ClaimsAdded = true;

            // Return true, which indicates this need not be called again.
            bRet = true;
        }
        else
        {
            // This point should not be reached, but just in case...
            bRet = true;
        }

        return bRet;
    }
    public ClaimSet Issuer
    {
        get { return ClaimSet.System; }
    }

    public string Id
    {
        get { return id; }
    }

    // This method returns a collection of action strings that indicate the
    // operations that the specified username is allowed to call.
    private IEnumerable<string> GetAllowedOpList(string username)
    {
        IList<string> ret = new List<string>();

        if (username == "test1")
        {
            ret.Add ( "http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add ("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply");
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        else if (username == "test2")
        {
            ret.Add ( "http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add ("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        return ret;
    }

    // internal class for state
    class CustomAuthState
    {
        bool bClaimsAdded;

        public CustomAuthState()
        {
            bClaimsAdded = false;
        }

        public bool ClaimsAdded { get { return bClaimsAdded; }
                                  set {  bClaimsAdded = value; } }
    }
}

Public Class MyAuthorizationPolicy
    Implements IAuthorizationPolicy
    Private value_id As String


    Public Sub New()
        value_id = Guid.NewGuid().ToString()

    End Sub 

    Public Function Evaluate(ByVal evaluationContext As EvaluationContext, _
         ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate

        Dim bRet As Boolean = False
        Dim customstate As CustomAuthState = Nothing

        ' If state is null, then this method has not been called before, so 
        ' set up a custom state.
        If state Is Nothing Then
            customstate = New CustomAuthState()
            state = customstate
        Else
            customstate = CType(state, CustomAuthState)
        End If
        Console.WriteLine("Inside MyAuthorizationPolicy::Evaluate")

        ' If the claims have not been added yet...
        If Not customstate.ClaimsAdded Then
            ' Create an empty list of Claims
            Dim claims As New List(Of Claim)

            ' Iterate through each of the claimsets in the evaluation context.
            Dim cs As ClaimSet
            For Each cs In evaluationContext.ClaimSets
                ' Look for Name claims in the current claim set.
                Dim c As Claim
                For Each c In cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty)
                    ' Get the list of operations the given username is allowed to call.
                    Dim s As String
                    For Each s In GetAllowedOpList(c.Resource.ToString())

                        ' Add claims to the list
                        claims.Add(New Claim("http://example.org/claims/allowedoperation", _
                                    s, Rights.PossessProperty))
                        Console.WriteLine("Claim added {0}", s)
                    Next s
                Next c
            Next cs 
            
            ' Add claims to the evaluation context.
            evaluationContext.AddClaimSet(Me, New DefaultClaimSet(Me.Issuer, claims))

            ' Record that claims have been added.
            customstate.ClaimsAdded = True

            ' Return true, which indicates the method need not to be called again.
            bRet = True
        Else
            ' Should never get here, but just in case...
            bRet = True
        End If


        Return bRet

    End Function 'Evaluate

    Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer

        Get
            Return ClaimSet.System
        End Get
    End Property

    Public ReadOnly Property Id() As String Implements IAuthorizationPolicy.Id

        Get
            Return value_id
        End Get
    End Property
    ' This method returns a collection of action strings that indicate the 
    ' operations that the specified username is allowed to call.
    Private Shared Function GetAllowedOpList(ByVal username As String) As IEnumerable(Of String)


        Dim ret As New List(Of String)

        If username = "test1" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        ElseIf username = "test2" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        End If
        Return ret

    End Function 

    ' This is an internal class for state.
    Class CustomAuthState
        Private bClaimsAdded As Boolean


        Public Sub New()

        End Sub 


        Public Property ClaimsAdded() As Boolean
            Get
                Return bClaimsAdded
            End Get
            Set(ByVal value As Boolean)
                bClaimsAdded = value
            End Set
        End Property
    End Class 
End Class

설명

한 클레임 집합을 다른 클레임 집합에 추가하거나 매핑하기 위한 IAuthorizationPolicy 인터페이스를 구현합니다. 권한 부여 정책에서는 클레임 집합을 검사하고 현재 집합에 따라 추가 클레임을 추가합니다. 예를 들어, 권한 부여 정책에서는 생년월일이 포함된 클레임을 평가한 다음 사용자가 21살이 넘었음을 주장하는 클레임을 추가하고 Over21 클레임을 EvaluationContext에 추가할 수 있습니다.

IAuthorizationPolicy 인터페이스를 구현하는 클래스는 사용자에게 권한을 부여하지 않지만 ServiceAuthorizationManager 클래스를 통해 사용자에게 권한을 부여할 수 있도록 합니다. ServiceAuthorizationManager는 적용되는 각 권한 부여 정책에 대해 Evaluate 메서드를 호출합니다. Evaluate 메서드는 현재 컨텍스트를 기반으로 사용자에 대해 추가 클레임을 추가해야 할지 여부를 확인합니다. 권한 부여 정책의 Evaluate 메서드는 다른 권한 부여 정책에서 EvaluationContext에 클레임을 추가할 때 여러 번 호출될 수 있습니다. 적용되는 모든 권한 부여 정책이 완료되면 ServiceAuthorizationManager 클래스는 최종 클레임 집합을 기반으로 권한 부여 결정을 내립니다. 그런 다음 ServiceAuthorizationManager 클래스는 이러한 권한 부여 결정을 반영하는 변경 불가능한 클레임 집합이 포함된 AuthorizationContext를 만듭니다.

속성

Id	이 권한 부여 구성 요소를 식별하는 문자열을 가져옵니다. (다음에서 상속됨 IAuthorizationComponent)
Issuer	권한 부여 정책의 발급자를 나타내는 클레임 집합을 가져옵니다.

메서드

Evaluate(EvaluationContext, Object)

사용자가 이 권한 부여 정책에 대한 요구 사항을 충족하는지 여부를 평가합니다.

추가 정보

• 권한 부여 정책 샘플