如何：建立自定義授權原則

發行項
04/01/2025

Windows Communication Foundation （WCF）中的身分識別模型基礎結構支援宣告型授權模型。宣告會從令牌中擷取，經由自訂授權原則選擇性地進行處理，然後放入AuthorizationContext，以供檢查並做出授權決策。自定義原則可用來將宣告從傳入令牌轉換成應用程式預期的宣告。如此一來，應用層就不會受到 WCF 支援的不同令牌類型下不同宣告細節的影響。本主題說明如何實作自定義授權原則，以及如何將該原則新增至服務所使用的原則集合。

實作自定義授權原則

定義衍生自 IAuthorizationPolicy的新類別。
實作只讀 Id 屬性，方法是在類別的建構函式中產生唯一字串，並在每次存取屬性時傳回該字串。
為了實作唯讀的 Issuer 屬性，傳回一個代表政策簽發者的 ClaimSet。這可能是代表應用程式的 ClaimSet 或內建的 ClaimSet（例如，靜態屬性 System 所傳回的 ClaimSet）。
如下列程式所述，實作 Evaluate(EvaluationContext, Object) 方法。

實現 Evaluate 方法

兩個參數會傳遞至這個方法：EvaluationContext 類別的實例和對象參考。
如果自定義授權原則在不考慮 EvaluationContext現有內容的情況下添加 ClaimSet 實例，則通過調用 AddClaimSet(IAuthorizationPolicy, ClaimSet) 方法來添加每個 ClaimSet 並從 Evaluate 方法返回 true。傳回 true 會向授權基礎結構指出授權原則已執行其工作，而且不需要再次呼叫。
如果自訂授權原則只有在 EvaluationContext中已有特定宣告時，才新增宣告集，則檢查 ClaimSets 屬性傳回的 ClaimSet 實例以尋找這些宣告。如果宣告存在，則藉由呼叫 AddClaimSet(IAuthorizationPolicy, ClaimSet) 方法來新增新的宣告集，若沒有更多宣告集需要新增，則傳回 true，表示授權基礎結構的授權原則已完成其工作。如果權益聲明不存在，則傳回 false，指出如果其他授權原則將更多權益聲明集新增至 EvaluationContext，應該再次呼叫授權原則。
在更複雜的處理案例中，Evaluate(EvaluationContext, Object) 方法的第二個參數是用來儲存授權基礎結構會在每次後續呼叫 Evaluate(EvaluationContext, Object) 方法時傳回給特定評估的狀態變數。

透過組態指定自定義授權原則

在 serviceAuthorization 元素中的 authorizationPolicies 元素的 add 元素中，指定 policyType 屬性中的自定義授權原則類型。

<configuration>  
 <system.serviceModel>  
  <behaviors>  
    <serviceAuthorization serviceAuthorizationManagerType=  
              "Samples.MyServiceAuthorizationManager" >  
      <authorizationPolicies>  
        <add policyType="Samples.MyAuthorizationPolicy" />  
      </authorizationPolicies>  
    </serviceAuthorization>  
  </behaviors>  
 </system.serviceModel>  
</configuration>

透過程式代碼指定自定義授權原則

建立 IAuthorizationPolicy的 List<T>。
建立自定義授權原則的實例。
將授權原則實例新增至清單。
針對每個自定義授權原則重複步驟 2 和 3。

將清單的唯讀版本指派給 ExternalAuthorizationPolicies 屬性。

// Add a custom authorization policy to the service authorization behavior.
List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>();
policies.Add(new MyAuthorizationPolicy());
serviceHost.Authorization.ExternalAuthorizationPolicies = policies.AsReadOnly();

' Add custom authorization policy to service authorization behavior.
Dim policies As List(Of IAuthorizationPolicy) = New List(Of IAuthorizationPolicy)()
policies.Add(New MyAuthorizationPolicy())
serviceHost.Authorization.ExternalAuthorizationPolicies = policies.AsReadOnly()

範例

下列範例示範完整的 IAuthorizationPolicy 實作。

public class MyAuthorizationPolicy : IAuthorizationPolicy
{
    string id;

    public MyAuthorizationPolicy()
    {
        id = Guid.NewGuid().ToString();
    }

    public bool Evaluate(EvaluationContext evaluationContext, ref object state)
    {
        bool bRet = false;
        CustomAuthState customstate = null;

        // If the state is null, then this has not been called before so
        // set up a custom state.
        if (state == null)
        {
            customstate = new CustomAuthState();
            state = customstate;
        }
        else
        {
            customstate = (CustomAuthState)state;
        }

        // If claims have not been added yet...
        if (!customstate.ClaimsAdded)
        {
            // Create an empty list of claims.
            IList<Claim> claims = new List<Claim>();

            // Iterate through each of the claim sets in the evaluation context.
            foreach (ClaimSet cs in evaluationContext.ClaimSets)
                // Look for Name claims in the current claimset.
                foreach (Claim c in cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty))
                    // Get the list of operations the given username is allowed to call.
                    foreach (string s in GetAllowedOpList(c.Resource.ToString()))
                    {
                        // Add claims to the list.
                        claims.Add(new Claim("http://example.org/claims/allowedoperation", s, Rights.PossessProperty));
                        Console.WriteLine($"Claim added {s}");
                    }

            // Add claims to the evaluation context.
            evaluationContext.AddClaimSet(this, new DefaultClaimSet(this.Issuer, claims));

            // Record that claims were added.
            customstate.ClaimsAdded = true;

            // Return true, indicating that this method does not need to be called again.
            bRet = true;
        }
        else
        {
            // Should never get here, but just in case, return true.
            bRet = true;
        }

        return bRet;
    }

    public ClaimSet Issuer
    {
        get { return ClaimSet.System; }
    }

    public string Id
    {
        get { return id; }
    }

    // This method returns a collection of action strings that indicate the
    // operations the specified username is allowed to call.
    private IEnumerable<string> GetAllowedOpList(string username)
    {
        IList<string> ret = new List<string>();

        if (username == "test1")
        {
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply");
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        else if (username == "test2")
        {
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add");
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract");
        }
        return ret;
    }

    // Internal class for keeping track of state.
    class CustomAuthState
    {
        bool bClaimsAdded;

        public CustomAuthState()
        {
            bClaimsAdded = false;
        }

        public bool ClaimsAdded
        {
            get { return bClaimsAdded; }
            set { bClaimsAdded = value; }
        }
    }
}


Public Class MyAuthorizationPolicy
    Implements IAuthorizationPolicy
    Private id_Value As String


    Public Sub New()
        id_Value = Guid.NewGuid().ToString()

    End Sub


    Public Function Evaluate(ByVal evaluationContext As EvaluationContext, ByRef state As Object) As Boolean _
        Implements IAuthorizationPolicy.Evaluate
        Dim bRet As Boolean = False
        Dim customstate As CustomAuthState = Nothing

        ' If the state is null, then this has not been called before, so set up
        ' our custom state.
        If state Is Nothing Then
            customstate = New CustomAuthState()
            state = customstate
        Else
            customstate = CType(state, CustomAuthState)
        End If
        ' If claims have not been added yet...
        If Not customstate.ClaimsAdded Then
            ' Create an empty list of Claims.
            Dim claims as IList(Of Claim) = New List(Of Claim)()

            ' Iterate through each of the claimsets in the evaluation context.
            Dim cs As ClaimSet
            For Each cs In evaluationContext.ClaimSets
                ' Look for Name claims in the current claimset...
                Dim c As Claim
                For Each c In cs.FindClaims(ClaimTypes.Name, Rights.PossessProperty)
                    ' Get the list of operations that the given username is allowed to call.
                    Dim s As String
                    For Each s In GetAllowedOpList(c.Resource.ToString())
                        ' Add claims to the list.
                        claims.Add(New Claim("http://example.org/claims/allowedoperation", s, Rights.PossessProperty))
                        Console.WriteLine("Claim added {0}", s)
                    Next s
                Next c
            Next cs ' Add claims to the evaluation context.
            evaluationContext.AddClaimSet(Me, New DefaultClaimSet(Me.Issuer, claims))

            ' Record that claims were added.
            customstate.ClaimsAdded = True

            ' Return true, indicating that this does not need to be called again.
            bRet = True
        Else
            ' Should never get here, but just in case...
            bRet = True
        End If


        Return bRet

    End Function

    Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer
        Get
            Return ClaimSet.System
        End Get
    End Property

    Public ReadOnly Property Id() As String Implements IAuthorizationPolicy.Id
        Get
            Return id_Value
        End Get
    End Property
    ' This method returns a collection of action strings that indicate the
    ' operations the specified username is allowed to call.

    ' Operations the specified username is allowed to call.
    Private Function GetAllowedOpList(ByVal userName As String) As IEnumerable(Of String)
        Dim ret As IList(Of String) = new List(Of String)()
        If username = "test1" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Multiply")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        ElseIf username = "test2" Then
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Add")
            ret.Add("http://Microsoft.ServiceModel.Samples/ICalculator/Subtract")
        End If
        Return ret
    End Function

    ' internal class for keeping track of state

    Class CustomAuthState
        Private bClaimsAdded As Boolean


        Public Sub New()
            bClaimsAdded = False

        End Sub


        Public Property ClaimsAdded() As Boolean
            Get
                Return bClaimsAdded
            End Get
            Set
                bClaimsAdded = value
            End Set
        End Property
    End Class
End Class

共用方式為

如何：建立自定義授權原則

實作自定義授權原則

實現 Evaluate 方法

透過組態指定自定義授權原則

透過程式代碼指定自定義授權原則

範例

另請參閱

其他資源