Implementing authorization in web applications and APIs - Dominick Baier & Brock Allen
Why Stack Overflow recommends it
Stack Overflow users link it as the go-to starting point for authorization design in ASP.NET Core and IdentityServer questions, especially when people confuse authentication with authorization or overload tokens with roles.
Recommended by 4 people across 6 different months, 2017 to 2022.
What it is
A conference talk from NDC Oslo in which Dominick Baier and Brock Allen explain approaches and pitfalls of authorization in web apps and APIs. They use the ASP.NET Core authorization API (policies, requirements, handlers) as an example of a clean abstraction, stressing that no single approach fits every application.
What people said
Strong rec Matt G · 2017-09 · Stack Overflow · on “Reusing a bearer token for multiple API calls”
I agree with you. If authorisation information is in the token, then don't share between apis, if it's not then it should be ok to share. At the moment I think a lot of people include authorisation in the token. This talk was very informative: [this video] Thanks, nice chat :)
Recommends Daniel Botero Correa · 2017-09 · Stack Overflow · on “Authorization based on assigned Permission function”
Alsamil, If you have time, please read about the new way Microsoft is doing Claims-Based Authorization [LINK] And if you have even more time, I really recommend you this [this video] conference. Dominick Baier & Brock Allen are really known in the security industry and they explain how to do Authorisation in a really nice way which is related to the Claims-Based Authorization [LINK] article. If I am not wrong they are the minds behind this new way of authorisation.
Recommends Jammer · 2018-06 · Stack Overflow · on “Client specific role based authentication?”
Personally I think you need to move away from using the [Authorize] attribute entirely. It's clear that your requirements for authorisation are more complex than that method "out-the-box" was intended for. Also in the question about I think Authentication and Authorisation are being used interchangably. What we are dealing with here is Authorisation. Since you are using Identity and claims based authorisation. I would look at doing this "on-the-fly" so to speak. Along with claims you could make use of dynamic policy generation as well as service based Authorisation using IAuthorizationRequirement instances to build up complex rules and requirements. Going into depth on the implementation of
Recommends Tore Nestenius · 2020-07 · Stack Overflow · on “IdentityServer4 shows 404 - Request Too Long”
If you need to add 200 roles to a given user then you are definitively doing it wrong. The list of roles should not be included in the tokens and I guess one user is never part of 200 roles? only a few? You should only include the roles that are actually used for a given user in the tokens. This video Implementing authorization in web applications and APIs [this video] I is a good starting point For example in your client appplication, if you need to lookup additional information as part of the login, then you can use claims transformations like: public class BonusLevelClaimTransformation : IClaimsTransformation { public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal) { if (!princ
Recommends Tore Nestenius · 2021-02 · Stack Overflow · on “identity server 4 authorize clients for certain user only”
You typically control that in the Authorization step in each client, not in IdentityServer. OpenIDConnect/Token is all about who is the user (authentication). Internally, in a typical ASP.NET Core application you have these modules as shown in the picture below. [LINK] The first authentication module is in charge of establishing who is the user. This is what we use OpenID connect. The second part is all about what is the person allowed to access. So to reduce the complexity of the application, then don't try to mix authentication and authorization. This video is a good stating point. [this video]
Recommends Tore Nestenius · 2022-01 · Stack Overflow · on “What is the best way to implement different User Roles/Permissions depending on "Project"?”
Authorization is hard and a good starting point is to watch this video: Implementing authorization in web applications and APIs [this video] . Then using the policies and requirements is how I would approach this and this resource is a good reference: Custom authorisation policies and requirements in ASP.NET Core [LINK] The picture below shows how the concept of requirements work in ASP.Net Core where you can define a requirement and then have one or many handlers independently "vote" if the user is approved or not. [LINK]
Recommends Tore Nestenius · 2022-02 · Stack Overflow · on “IdentityServer: fetch requests fails after some time because user gets authenticated again”
well, you use IdentityServer, so you could use the issued access tokens to control the access to the API but , as you are using JavaScript, you should consider the BFF pattern mentioned here [this video]
Cites Daniel Botero Correa · 2018-05 · Stack Overflow · on “Securing Legacy Web-Service site using anonymous authentication for local access”
Resource Owner Password Credentials Grant because as soon as you want to do something on behalf an user, the application has to use the user's access token to make the calls to the api so the endpoint can decides whether or not that user is allowed to execute the code inside the endpoint. (authorization must happen at the endpoint level and one usually use the claims inside the access token to decide whether the user can perform an action or not) [this video]
Cites André Luiz · 2018-11 · Stack Overflow · on “Secure asp.net core web api using authorize attributes + identity Server 4”
I managed to set up an Identity Server 4 using is4aspid from their templates [LINK] and it seems to be working fine. Now I'm trying to protect a Web Api using Asp.net Core 2.0. The Authorize seems to be working, but when I try to use [Authorize(Roles ="Admin")] in my controller method it won't work. I watched this video [this video] and tried to do what they did, but I can't find a good chunk of the code they use, like AuthorizationProviderClient or app.UseAuthorizationProvider() This is the Startup.cs ConfigureServices method of my Identity Server: public void ConfigureServices(IServiceCollection services) { services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer (Configurati
Cites Tonyc · 2020-07 · Stack Overflow · on “Right architecture for Authentication and Authorization with IdentityServer4”
After the above discussion and watching the video [this video] the conclusion is: authentication can be solved with IdentityServer4 for Authorization we just have some best practices as mapping claims to permissions with a rule engine that is specific to the application. the authorization logic can be applied by a new application: "Authorization Provider" (web api + web UI) that has the authorization business logic of all the application in the system. Everybody should write his own engine for authorization based on his own scenario.