Resource based Authorization

[rhlvig]

I have a navigation menu component that applies navigation-access Authorization policy on every li element. Now the policy is same but resource is different. Is there a way I can set resource and policy on Authorization context? Alternately can I include requirement handlers and then use SetClaims.

[egil]

HI @rhlvig,

Not sure I follow what you need or want in this case (not an auth expert admittedly). Can you show how you do it in a Blazor App? Then we can probably figure out how to do it in a bUnit context as well.

[rhlvig]

Here's an example of navigation menu. We have a policy called navigation-access that checks requirements as against resource. The requirements class checks that the user has claim type '/path/screen_1' with value 'navigate' to authorize and show list item. If I mock policy, everything will authorize or none would authorize. I can't do resource specific authorization checks.

<div class="nav-menu">
    <ul class="nav flex-column">
		<AuthorizeView Policy="@Policy.NAVIGATE_ACCESS" Resource="/path/screen_1">
			<li class="nav-item px-3">
				<NavLink class="nav-link" href="/path/screen_1">
					SCREEN 1
				</NavLink>
			</li>
		</AuthorizeView>
		<AuthorizeView Policy="@Policy.NAVIGATE_ACCESS" Resource="/path/screen_2">
			<li class="nav-item px-3">
				<NavLink class="nav-link" href="/path/screen_2">
					SCREEN 2
				</NavLink>
			</li>
		</AuthorizeView>
		<AuthorizeView Policy="@Policy.NAVIGATE_ACCESS" Resource="/path/screen_3">
			<li class="nav-item px-3">
				<NavLink class="nav-link" href="/path/screen_3">
					SCREEN 3
				</NavLink>
			</li>
		</AuthorizeView>
	</ul>
</div>

[egil]

Thanks, ill try to figure out what's going on ASAP.

Can you share what the the possible values are for @Policy.NAVIGATE_ACCESS?

[egil]

And how do you specify what the different Resource values should be (explain it to me like I dont understand much about the authorization and authentication stuff in asp.net and blazor).

What I am trying to understand is, what are you trying to test, or what test are you trying to write. If you could provide a none-working/compiling test, that sets up your component under test, which uses the <AuthorizeView> component with a policy and resource, that would be very helpful.

[rhlvig]

Resource and policy are both application specific. A resource is any object against which an authorization policy is checked. A policy defines requirements that need to be fulfilled by the resource. E.g. You have multi region data showing up on your screen. You define a policy called asia-only which defines requirement of resource being of region Asia. Resource in this case can be every record with Authorize view wrapped around every tr element, or it could be at controller level to filter the data. Now this example does not check Authorization of logged in user because I wanted to keep it simple, but you can use your imagination here. Policy can be region-access which checks user has say claim type regions matching with region on the resource. Hope this makes sense. What I request is an ability to mock combination of policy + resource.

[egil]

OK, thank you for explaining. So something like this?

using var ctx = new TestContext();
var authContext = ctx.AddTestAuthorization();
authContext.SetAuthorized("TEST USER");
authContext.SetPolicyWithResource("policy-name", "resource-name");

But what should be added to the FakeAuthorizationPolicyProvider in bUnit when you call SetPolicyWithResource?