Improving WIF’s Claims-based Authorization – Part 1

As mentioned in my last post, I made several additions to WIF’s built-in authorization infrastructure to make it more flexible and easy to use.

The foundation for all this work is that you have to be able to directly call the registered ClaimsAuthorizationManager. The following snippet is the universal way to get to the WIF configuration that is currently in effect:

public static ServiceConfiguration ServiceConfiguration
{
get
    {
if (OperationContext.Current == null
)
{
// no WCF
            return FederatedAuthentication
.ServiceConfiguration;
}

// search message property
        if (OperationContext.Current.IncomingMessageProperties.
ContainsKey(
“ServiceConfiguration”))
{
var configuration = OperationContext.Current.
IncomingMessageProperties[
“ServiceConfiguration”] as ServiceConfiguration
;

            if (configuration != null)
{
return
configuration;
}
}

// return configuration from configuration file
        return new ServiceConfiguration();
}
}  

From here you can grab ServiceConfiguration.ClaimsAuthoriationManager which give you direct access to the CheckAccess method (and thus control over claim types and values).

I then created the following wrapper methods:

public static bool CheckAccess(string resource, string action)
{
    return CheckAccess(resource, action, Thread.CurrentPrincipal as IClaimsPrincipal);
}


public
 static bool CheckAccess(string resource, string action, IClaimsPrincipal principal)
{
    var context = new AuthorizationContext(principal, resource, action);

return AuthorizationManager.CheckAccess(context);
}

public
 static bool CheckAccess(Collection<Claim> actions, Collection<Claim
> resources)
{
    return CheckAccess(new AuthorizationContext(
Thread
.CurrentPrincipal.AsClaimsPrincipal(), resources, actions));
}

public
 static bool CheckAccess(AuthorizationContext
context)
{
    return AuthorizationManager.CheckAccess(context);
}

I also created the same set of methods but called DemandAccess. They internally use CheckAccess and will throw a SecurityException when false is returned.

All the code is part of Thinktecture.IdentityModel on Codeplex – or via NuGet (Install-Package Thinktecture.IdentityModel).

This entry was posted in IdentityModel. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s