As mentioned in my last post, I made several additions to WIF’s built-in authorization infrastructure to make it more flexible and easy to use.

The foundation for all this work is that you have to be able to directly call the registered ClaimsAuthorizationManager. The following snippet is the universal way to get to the WIF configuration that is currently in effect:

public static ServiceConfiguration ServiceConfiguration
{
get
    {
if (OperationContext.Current == null)
{
// no WCF
            return FederatedAuthentication.ServiceConfiguration;
}

// search message property
        if (OperationContext.Current.IncomingMessageProperties.
ContainsKey(“ServiceConfiguration”))
{
var configuration = OperationContext.Current.
IncomingMessageProperties[“ServiceConfiguration”] as ServiceConfiguration;

            if (configuration != null)
{
return configuration;
}
}

// return configuration from configuration file
        return new ServiceConfiguration();
}
}  

From here you can grab ServiceConfiguration.ClaimsAuthoriationManager which give you direct access to the CheckAccess method (and thus control over claim types and values).

I then created the following wrapper methods:

public static bool CheckAccess(string resource, string action)
{
    return CheckAccess(resource, action, Thread.CurrentPrincipal as IClaimsPrincipal);
}

public static bool CheckAccess(string resource, string action, IClaimsPrincipal principal)
{
    var context = new AuthorizationContext(principal, resource, action);

return AuthorizationManager.CheckAccess(context);
}

public static bool CheckAccess(Collection<Claim> actions, Collection<Claim> resources)
{
    return CheckAccess(new AuthorizationContext(
Thread.CurrentPrincipal.AsClaimsPrincipal(), resources, actions));
}

public static bool CheckAccess(AuthorizationContext context)
{
    return AuthorizationManager.CheckAccess(context);
}

I also created the same set of methods but called DemandAccess. They internally use CheckAccess and will throw a SecurityException when false is returned.

All the code is part of Thinktecture.IdentityModel on Codeplex – or via NuGet (Install-Package Thinktecture.IdentityModel).