Integration with Role-based authorization in ASP.NET Core

In this section, you learn how to use Role-based authorization in an ASP.NET core project.

First of all, It's required to have a basic understanding of Role-based authorization in ASP.NET Core.

Configuration to enable Role-based authorization.

    public class Startup
    {
        //...
        public void ConfigureServices(IServiceCollection services)
        {
            //...
            services.AddAuthentication().AddCookie(o => o.Events.AddCookieValidateHandler());
            //...
        }

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            //...
            //Put UseRouting before UseAuthentication and UseAuthorization
            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();
            //...
        }
    }

Configuration to enable Role-based authorization if DNVGL.OAuth.Web is used in authentication.

    public class Startup
    {
        //...
        public void ConfigureServices(IServiceCollection services)
        {
            //...
            services.AddOidc(o =>
            {
                //....
            }, cookieOption => cookieOption.Events.AddCookieValidateHandler());
            //...
        }

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            //...
            //Put UseRouting before UseAuthentication and UseAuthorization
            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();
            //...
        }
    }

Then AuthorizeAttribute can be used to decorate an API to perfrom authorization.

        [HttpGet]
        [Authorize(Roles = "ReadWeather")]
        public IEnumerable<WeatherForecast> Get()
        {
            //... api logic
        }

Alternatively, PermissionAuthorizeAttribute is still working.

        [HttpGet]
        [PermissionAuthorize(WeatherPermission.ReadWeather)]
        public IEnumerable<WeatherForecast> Get()
        {
            //... api logic
        }