asp.net core 授权（1）

IAuthorizeDate接口代表了授权系统的源头：

public interface IAuthorizeData
{
    string Policy { get; set; }
    string Roles { get; set; }
    string AuthenticationSchemes { get; set; }
}

接口中定义的三个属性分别代表了三种授权类型：

1、基于角色的授权：

[Authorize(Roles = "Admin")] // 多个Role可以使用,分割
public class SampleDataController : Controller
{
    ...
}

2、基于scheme的授权：

[Authorize(AuthenticationSchemes = "Cookies")] // 多个Scheme可以使用,分割
public class SampleDataController : Controller
{
    ...
}

3、基于策略的授权：

[Authorize(Policy = "EmployeeOnly")]
public class SampleDataController : Controller
{
    
}

基于策略的授权是授权的核心，使用这种授权策略时，首先要定义策略：

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();

    services.AddAuthorization(options =>
    {
        options.AddPolicy("EmployeeOnly", policy => policy.RequireClaim("EmployeeNumber"));
    });
}

授权策略本质上就是对claims的一系列断言。

而基于角色和基于scheme的授权都是一种语法糖，最终会转换为策略授权。

详解

整个asp.net core的授权配置通过一个AddAuthorization来进行的：

public static IServiceCollection AddAuthorization(
      this IServiceCollection services,
      Action<AuthorizationOptions> configure)
    {
      if (services == null)
        throw new ArgumentNullException(nameof (services));
      services.AddAuthorizationCore(configure);
      services.AddAuthorizationPolicyEvaluator();
      return services;
    }

public static IServiceCollection AddAuthorization(
      this IServiceCollection services,
      Action<AuthorizationOptions> configure)
    {
      if (services == null)
        throw new ArgumentNullException(nameof (services));
      services.AddAuthorizationCore(configure);
      services.AddAuthorizationPolicyEvaluator();
      return services;
    }

public static IServiceCollection AddAuthorizationCore(
      this IServiceCollection services,
      Action<AuthorizationOptions> configure)
    {
      if (services == null)
        throw new ArgumentNullException(nameof (services));
      if (configure != null)
        services.Configure<AuthorizationOptions>(configure);
      return services.AddAuthorizationCore();
    }

public static IServiceCollection AddAuthorizationCore(
  this IServiceCollection services)
{
  if (services == null)
    throw new ArgumentNullException(nameof (services));
  services.TryAdd(ServiceDescriptor.Transient<IAuthorizationService, DefaultAuthorizationService>());
  services.TryAdd(ServiceDescriptor.Transient<IAuthorizationPolicyProvider, DefaultAuthorizationPolicyProvider>());
  services.TryAdd(ServiceDescriptor.Transient<IAuthorizationHandlerProvider, DefaultAuthorizationHandlerProvider>());
  services.TryAdd(ServiceDescriptor.Transient<IAuthorizationEvaluator, DefaultAuthorizationEvaluator>());
  services.TryAdd(ServiceDescriptor.Transient<IAuthorizationHandlerContextFactory, DefaultAuthorizationHandlerContextFactory>());
  services.TryAddEnumerable(ServiceDescriptor.Transient<IAuthorizationHandler, PassThroughAuthorizationHandler>());
  return services;
}

 public static IServiceCollection AddAuthorizationPolicyEvaluator(
      this IServiceCollection services)
    {
      if (services == null)
        throw new ArgumentNullException(nameof (services));
      services.TryAddSingleton<AuthorizationPolicyMarkerService>();
      services.TryAdd(ServiceDescriptor.Transient<IPolicyEvaluator, PolicyEvaluator>());
      return services;
    }

AuthorizationOptions

典型的Options模式，设置和获取授权策略的入口点

public class AuthorizationOptions
  {
    private IDictionary<string, AuthorizationPolicy> PolicyMap { get; } = (IDictionary<string, AuthorizationPolicy>) new Dictionary<string, AuthorizationPolicy>((IEqualityComparer<string>) StringComparer.OrdinalIgnoreCase);

    public bool InvokeHandlersAfterFailure { get; set; } = true;

    public AuthorizationPolicy DefaultPolicy { get; set; } = new AuthorizationPolicyBuilder(Array.Empty<string>()).RequireAuthenticatedUser().Build();

    public AuthorizationPolicy FallbackPolicy { get; set; }

    public void AddPolicy(string name, AuthorizationPolicy policy)
    {
      if (name == null)
        throw new ArgumentNullException(nameof (name));
      if (policy == null)
        throw new ArgumentNullException(nameof (policy));
      this.PolicyMap[name] = policy;
    }

    public void AddPolicy(string name, Action<AuthorizationPolicyBuilder> configurePolicy)
    {
      if (name == null)
        throw new ArgumentNullException(nameof (name));
      if (configurePolicy == null)
        throw new ArgumentNullException(nameof (configurePolicy));
      AuthorizationPolicyBuilder authorizationPolicyBuilder = new AuthorizationPolicyBuilder(Array.Empty<string>());
      configurePolicy(authorizationPolicyBuilder);
      this.PolicyMap[name] = authorizationPolicyBuilder.Build();
    }

    public AuthorizationPolicy GetPolicy(string name)
    {
      if (name == null)
        throw new ArgumentNullException(nameof (name));
      return !this.PolicyMap.ContainsKey(name) ? (AuthorizationPolicy) null : this.PolicyMap[name];
    }
  }

这个类中的几个重要的属性和方法：

1、PolicyMap，类型为IDictionary<string, AuthorizationPolicy>，维护一个授权策略的字典。

2、DefaultPolicy ，类型为AuthorizationPolicy，这个默认的策略要求用户必须登录

3、FallbackPolicy ，类型为AuthorizationPolicy，这个用来作为后备的授权策略

4、AddPolicy()，用来维护PolicyMap

5、GetPolicy()，用来根据名称获取相应的Policy，获取不到会返回null

综上，AuthorizationOptions就是用来设置和获取授权策略的。

AuthorizationPolicy

表示一个授权策略

public class AuthorizationPolicy
  {
    public AuthorizationPolicy(
      IEnumerable<IAuthorizationRequirement> requirements,
      IEnumerable<string> authenticationSchemes)
    {
      if (requirements == null)
        throw new ArgumentNullException(nameof (requirements));
      if (authenticationSchemes == null)
        throw new ArgumentNullException(nameof (authenticationSchemes));
      if (requirements.Count<IAuthorizationRequirement>() == 0)
        throw new InvalidOperationException(Resources.Exception_AuthorizationPolicyEmpty);
      this.Requirements = (IReadOnlyList<IAuthorizationRequirement>) new List<IAuthorizationRequirement>(requirements).AsReadOnly();
      this.AuthenticationSchemes = (IReadOnlyList<string>) new List<string>(authenticationSchemes).AsReadOnly();
    }

    public IReadOnlyList<IAuthorizationRequirement> Requirements { get; }

    public IReadOnlyList<string> AuthenticationSchemes { get; }

    public static AuthorizationPolicy Combine(
      params AuthorizationPolicy[] policies)
    {
      if (policies == null)
        throw new ArgumentNullException(nameof (policies));
      return AuthorizationPolicy.Combine((IEnumerable<AuthorizationPolicy>) policies);
    }

    public static AuthorizationPolicy Combine(
      IEnumerable<AuthorizationPolicy> policies)
    {
      if (policies == null)
        throw new ArgumentNullException(nameof (policies));
      AuthorizationPolicyBuilder authorizationPolicyBuilder = new AuthorizationPolicyBuilder(Array.Empty<string>());
      foreach (AuthorizationPolicy policy in policies)
        authorizationPolicyBuilder.Combine(policy);
      return authorizationPolicyBuilder.Build();
    }

    public static async Task<AuthorizationPolicy> CombineAsync(
      IAuthorizationPolicyProvider policyProvider,
      IEnumerable<IAuthorizeData> authorizeData)
    {
      if (policyProvider == null)
        throw new ArgumentNullException(nameof (policyProvider));
      if (authorizeData == null)
        throw new ArgumentNullException(nameof (authorizeData));
      bool flag1 = false;
      if (authorizeData is IList<IAuthorizeData> authorizeDataList)
        flag1 = authorizeDataList.Count == 0;
      AuthorizationPolicyBuilder policyBuilder = (AuthorizationPolicyBuilder) null;
      if (!flag1)
      {
        foreach (IAuthorizeData authorizeData1 in authorizeData)
        {
          IAuthorizeData authorizeDatum = authorizeData1;
          if (policyBuilder == null)
            policyBuilder = new AuthorizationPolicyBuilder(Array.Empty<string>());
          //Avoid allocating enumerator if the data is known to be empty
          bool flag2 = true;
          if (!string.IsNullOrWhiteSpace(authorizeDatum.Policy))
          {
            AuthorizationPolicy policyAsync = await policyProvider.GetPolicyAsync(authorizeDatum.Policy);
            if (policyAsync == null)
              throw new InvalidOperationException(Resources.FormatException_AuthorizationPolicyNotFound((object) authorizeDatum.Policy));
            policyBuilder.Combine(policyAsync);
            flag2 = false;
          }
          string[] strArray1 = authorizeDatum.Roles?.Split(',', StringSplitOptions.None);
          if (strArray1 != null && ((IEnumerable<string>) strArray1).Any<string>())
          {
            policyBuilder.RequireRole(((IEnumerable<string>) strArray1).Where<string>((Func<string, bool>) (r => !string.IsNullOrWhiteSpace(r))).Select<string, string>((Func<string, string>) (r => r.Trim())));
            flag2 = false;
          }
          string[] strArray2 = authorizeDatum.AuthenticationSchemes?.Split(',', StringSplitOptions.None);
          if (strArray2 != null && ((IEnumerable<string>) strArray2).Any<string>())
          {
            foreach (string str in strArray2)
            {
              if (!string.IsNullOrWhiteSpace(str))
                policyBuilder.AuthenticationSchemes.Add(str.Trim());
            }
          }
          if (flag2)
          {
            AuthorizationPolicyBuilder authorizationPolicyBuilder = policyBuilder;
            authorizationPolicyBuilder.Combine(await policyProvider.GetDefaultPolicyAsync());
            authorizationPolicyBuilder = (AuthorizationPolicyBuilder) null;
          }
          authorizeDatum = (IAuthorizeData) null;
        }
      }
      if (policyBuilder == null)
      {
        AuthorizationPolicy fallbackPolicyAsync = await policyProvider.GetFallbackPolicyAsync();
        if (fallbackPolicyAsync != null)
          return fallbackPolicyAsync;
      }
      return policyBuilder?.Build();
    }
  }

AuthorizationPolicy维护了两个只读的列表，一个是IAuthorizationRequirement的，另一个是string类型的，表示AuthenticationSchemes。又两个方法，一个是Combine()，这个方法是直接通过AuthorizePolicyBuilder来build的，还有一个CombineAsync方法，则是将我们上面介绍的IAuthorizeData转换成AuthorizePolicy，所以说，基于角色的授权和基于方案（AuthenticationScheme）的授权都会转换成基于策略的授权。

CombineAsync方法执行流程如下：

1、对传入的参数（IAuthorizationPolicyProvider 和IEnumerable<IAuthorizeData>）进行断言，不能为空，否则抛出异常。

2、声明一个布尔类型变量（上面是flag1），表示如果已知数据（IEnumerable<IAuthorizeData>）为空，则避免分配枚举数（Avoid allocating enumerator if the data is known to be empty），这个值的设置方式为对传入的authorizeData参数进行校验，首先判断是否为IList<T>，然后判断它的Count属性是否等于0。两者都为true则这个布尔值为true。

3、对第二步声明的这个布尔值进行判断，如果为false，那么进入方法体：

      ①对传入的authorizeData进行迭代，迭代方法内部做如下处理：

       ①-①初始化一个AuthorizationPolicyBuilder，声明一个布尔变量（flag2），默认值为true，这个变量表示是否使用默认的授权策略（useDefaultPolicy）。

       ①-②判断每一个迭代变量（authorizeDatum），如果Policy属性不为空，那么进入方法体，利用传入的policyProvider的GetPolicyAsync()方法，将authorizeDatum的Policy作为参数传入拿到一个AuthorizePolicy并赋值给一 个policyAsync变量。如果这个policyAsync为空，那么就抛出异常。如果不为空，那么利用①-①初始化的这个AuthorizePolicyBuilder来Combine这个获取到的policyAsync。然后将①-①中声明的flag2设置为false。这两步就将authorizeDatum这个迭代变量中的Policy情况处理完了。

      ①-③继续处理authorizeDatum中的roles，还是利用AuthorizationPolicyBuilder的RequireRoles将这个IAuthorizeData接口中的Roles处理

      ①-④继续处理authorizeDatum中的AuthenticationSchemes，同样利用AuthorizationPolicyBuilder将这个IAuthorizeData接口中的AuthenticationSchemes处理

      ①-⑤判断在①-①中声明的flag2，如果这个布尔值还是True，那么就用①-①中声明的AuthorizationPolicyBuilder来初始化一个默认的AuthorizationPolicy，这个默认的AuthorizationPolicy就是一个查看用户是否认证过的policy。至于这个flag2标记，会在检查过每一个迭代变量authorizeDatum的policy和roles之后进行相应的设置，如果authorizeDatum的policy和roles都没有，那么这个值就保持为true，反之会被设置为false。

      至此都是CombineAsync这个方法传入的这个authorizeData参数有值的情况下，如果传入的authorizeData没有值，那么从传入的policyProvider参数中拿到一个FallBackPolicy,由于policyProvider依赖于AuthorizatoinOptions，所以对PolicyProvider进行的操作基本都是对AuthorizationOptions的操作。

      总结：AuthorizationPolicyBuilder在Build方法执行前一直在维护两个关键的属性：

public IList<IAuthorizationRequirement> Requirements { get; set; } = (IList<IAuthorizationRequirement>) new List<IAuthorizationRequirement>();

public IList<string> AuthenticationSchemes { get; set; } = (IList<string>) new List<string>();

这两个属性也是IAuthorizationPolicy中的两个属性，AuthorizationPolicyBuilder装配一个AuthorizationPolicy的方式有三种，一个是Combine（），这个是将传入的一个Policy进行拆解，将它里面的这两个属性添加到AuthorizationPolicyBuilder中，一个是各种RequireXXXX方法体现出来的，最终都是创建一个IAuthorizationRequirment，添加在自身的Requirements属性中，还有一个是AddAuthenticationSchemes()，将 代表scheme的字符串添加到自身的AuthenticationSchemes属性中，当Build方法执行时，直接新建一个AuthorizationPolicy，将自身维护的这两个属性传入AuthorizationPolicy的构造函数中。