Improving WIF’s Claims-based Authorization - Part 1
Posted
by Your DisplayName here!
on Least Privilege
See other posts from Least Privilege
or by Your DisplayName here!
Published on Tue, 03 May 2011 08:55:20 GMT
Indexed on
2011/06/20
16:38 UTC
Read the original article
Hit count: 383
As mentioned in my last post, I made several additions to WIF’s built-in authorization infrastructure to make it more flexible and easy to use.
The foundation for all this work is that you have to be able to directly call the registered ClaimsAuthorizationManager. The following snippet is the universal way to get to the WIF configuration that is currently in effect:
public static ServiceConfiguration ServiceConfiguration
{
get
{
if (OperationContext.Current == null)
{
// no WCF
return FederatedAuthentication.ServiceConfiguration;
}
// search message property
if (OperationContext.Current.IncomingMessageProperties.
ContainsKey("ServiceConfiguration"))
{
var configuration = OperationContext.Current.
IncomingMessageProperties["ServiceConfiguration"] as ServiceConfiguration;
if (configuration != null)
{
return configuration;
}
}
// return configuration from configuration file
return new ServiceConfiguration();
}
}
From here you can grab ServiceConfiguration.ClaimsAuthoriationManager which give you direct access to the CheckAccess method (and thus control over claim types and values).
I then created the following wrapper methods:
public static bool CheckAccess(string resource, string action)
{
return CheckAccess(resource,
action, Thread.CurrentPrincipal as IClaimsPrincipal);
}
public static bool CheckAccess(string resource, string action, IClaimsPrincipal principal)
{
var context
= new AuthorizationContext(principal,
resource, action);
return AuthorizationManager.CheckAccess(context);
}
public static bool CheckAccess(Collection<Claim>
actions, Collection<Claim>
resources)
{
return CheckAccess(new AuthorizationContext(
Thread.CurrentPrincipal.AsClaimsPrincipal(),
resources, actions));
}
public static bool CheckAccess(AuthorizationContext context)
{
return AuthorizationManager.CheckAccess(context);
}
I also created the same set of methods but called DemandAccess. They internally use CheckAccess and will throw a SecurityException when false is returned.
All the code is part of Thinktecture.IdentityModel on Codeplex – or via NuGet (Install-Package Thinktecture.IdentityModel).
© Least Privilege or respective owner
