dfd9c16f61
This migration updates the ScopesJson for the ApiClient with Id 91000000-0000-0000-0000-000000000001 to include additional authorization scopes for improved API access control. The Down method reverts the changes if necessary.
51 lines
2.6 KiB
C#
51 lines
2.6 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
|
|
namespace Microsoft.SelfService.Portal.Core.API.Authorization
|
|
{
|
|
public static class AuthorizationServiceCollectionExtensions
|
|
{
|
|
public static IServiceCollection AddSelfServicePortalAuthorization(this IServiceCollection services)
|
|
{
|
|
services.AddAuthorization(options =>
|
|
{
|
|
options.FallbackPolicy = options.DefaultPolicy;
|
|
|
|
AddScopePolicy(options, ApiPolicies.ConfigurationRead, ApiScopes.ConfigurationRead, ApiScopes.ConfigurationWrite);
|
|
AddScopePolicy(options, ApiPolicies.ConfigurationWrite, ApiScopes.ConfigurationWrite);
|
|
AddScopePolicy(options, ApiPolicies.CredentialRead, ApiScopes.CredentialRead, ApiScopes.CredentialWrite, ApiScopes.CredentialResolve);
|
|
AddScopePolicy(options, ApiPolicies.CredentialWrite, ApiScopes.CredentialWrite);
|
|
AddScopePolicy(options, ApiPolicies.CredentialResolve, ApiScopes.CredentialResolve);
|
|
AddScopePolicy(options, ApiPolicies.DeploymentRead, ApiScopes.DeploymentRead, ApiScopes.DeploymentWrite);
|
|
AddScopePolicy(options, ApiPolicies.DeploymentWrite, ApiScopes.DeploymentWrite);
|
|
AddScopePolicy(options, ApiPolicies.QueueRead, ApiScopes.QueueRead, ApiScopes.QueueProcess);
|
|
AddScopePolicy(options, ApiPolicies.QueueProcess, ApiScopes.QueueProcess);
|
|
AddScopePolicy(options, ApiPolicies.TemplateRead, ApiScopes.TemplateRead, ApiScopes.TemplateWrite);
|
|
AddScopePolicy(options, ApiPolicies.TemplateWrite, ApiScopes.TemplateWrite);
|
|
AddScopePolicy(options, ApiPolicies.TokenManage, ApiScopes.TokenManage, ApiScopes.TokenAdmin);
|
|
AddScopePolicy(options, ApiPolicies.TokenAdmin, ApiScopes.TokenAdmin);
|
|
});
|
|
|
|
return services;
|
|
}
|
|
|
|
private static void AddScopePolicy(AuthorizationOptions options, string policyName, params string[] acceptedScopes)
|
|
{
|
|
options.AddPolicy(policyName, policy => policy.RequireAssertion(context =>
|
|
{
|
|
if (context.User.Identity?.IsAuthenticated != true)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var tokenScopes = context.User.FindAll("scope").Select(claim => claim.Value).ToList();
|
|
if (tokenScopes.Count == 0)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
return acceptedScopes.Any(scope => tokenScopes.Contains(scope, StringComparer.OrdinalIgnoreCase));
|
|
}));
|
|
}
|
|
}
|
|
}
|