.net core 7 AddAuthorizationRule not work

Question

.net core 7 AddAuthorizationRule not work

triumphtang opened this issue a year ago · 29 comments

Program:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("111", policy =>
        policy.Requirements.Add(new MinimumAgeRequirement()));
});

builder.Services.AddTransient<IAuthorizationHandler, MinimumAgeHandler>();

builder.Services.AddGraphQL(b => b
    .AddSchema<Common_Base_Schemas>()
    .AddSchema<IMS_Schemas>()

    .AddAutoClrMappings()
    .AddSystemTextJson()
    .AddAuthorizationRule());

var app = builder.Build();

app.UseDeveloperExceptionPage();

app.UseAuthentication();
app.UseAuthorization();

app.UseWebSockets();

Query:

    public class Query
    {
        [AllowAnonymous]
        public static CompanyEntity? companyEntity()
        {
            return new CompanyEntity() { rowkey = Guid.NewGuid().ToString(), CompanyId = "11", CompanyName = "12" };
        }
        [Authorize(Policy = "111")]
        public static IEnumerable<CompanyEntity>? companyAll()
        {
            return new CompanyEntity[] { new CompanyEntity() { rowkey = Guid.NewGuid().ToString(), CompanyId = "A11"} };
        }
    }

MinimumAgeRequirement ：

    public class MinimumAgeRequirement : IAuthorizationRequirement
    {
    }

MinimumAgeHandler :

    public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
    {
        protected override Task HandleRequirementAsync(
            AuthorizationHandlerContext context, MinimumAgeRequirement requirement)
        {
            context.Succeed(requirement);

            return Task.CompletedTask;
        }
    }

Error accessing "companyAll":

{
   "error": {
     "errors": [
       {
         "message": "Access denied for field 'companyAll' on type 'Query'.",
         "locations": [
           {
             "line": 10,
             "column": 3
           }
         ],
         "extensions": {
           "code": "ACCESS_DENIED",
           "codes": [
             "ACCESS_DENIED"
           ]
         }
       }
     ]
   }
}

Answer 1 · 2023-02-22T08:27:08.000Z

Can you post a list of the GraphQL nuget packages you have installed ?

Answer 2 · 2023-02-22T22:18:33.000Z

Thanks for you.
GraphQL.Server.All 7.2.0

Answer 3 · 2023-02-22T22:24:00.000Z

IMS_Schemas:

public class IMS_Schemas : Schema
{
    public IMS_Schemas(IServiceProvider serviceProvider) : base(serviceProvider)
    {
        Query = new AutoRegisteringObjectGraphType<Query>();
    }
}

Answer 4 · 2023-02-22T23:47:17.000Z

I tested the code you provided and it seems to work for me. See PR #994 -- all tests pass, both successful and access-denied tests for the modified sample project:

Samples.Authorization.Tests.EndToEndTests.GraphQLGet_Success
Samples.Authorization.Tests.EndToEndTests.GraphQLGet_AccessDenied
Samples.Authorization.Tests.EndToEndTests.GraphQLPost_Success
Samples.Authorization.Tests.EndToEndTests.GraphQLWebSocket_AccessDenied
Samples.Authorization.Tests.EndToEndTests.GraphQLWebSocket_AccessDenied

Can you paste the app.UseGraphQL() call(s) that you have?

Can you verify that your [Authorize] attribute references GraphQL.AuthorizeAttribute and not Microsoft.AspNetCore.Authorization.AuthorizeAttribute ?

Can you verify that you are not referencing any other GraphQL nuget packages?

Answer 5 · 2023-02-23T00:50:20.000Z

app.UseGraphQL<IMS_Schemas>("/IMS_Schemas/graphql");
app.UseGraphQLPlayground(
"/IMS_Schemas/ui/playground",
new GraphQL.Server.Ui.Playground.PlaygroundOptions
{
GraphQLEndPoint = "../graphql",
SubscriptionsEndPoint = "../graphql",
});

[Authorize] attribute references GraphQL.GraphQLAttribute

Thank for you.

Answer 6 · 2023-02-23T00:55:12.000Z

<PackageReference Include="GraphQL.Server.All" Version="7.2.0" />
<PackageReference Include="GraphQL.Server.Transports.AspNetCore" Version="7.2.0" />
<PackageReference Include="System.Reactive" Version="5.0.0" />

Answer 7 · 2023-02-23T00:57:45.000Z

Program.cs：

using GraphQL;
using KDRun.Model.GraphType.Common.Base;
using KDRun.Model.GraphType.IMS;
using KDRun.Service.ServiceAPI;
using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization(options =>
{
options.AddPolicy("111", policy =>
policy.Requirements.Add(new MinimumAgeRequirement()));
});

builder.Services.AddTransient<IAuthorizationHandler, MinimumAgeHandler>();

builder.Services.AddRazorPages();

builder.Services.AddGraphQL(b => b
.AddSchema<Common_Base_Schemas>()
.AddSchema<IMS_Schemas>()

.AddAutoClrMappings()
.AddSystemTextJson()
.AddAuthorizationRule());

//builder.Services.AddRouting();

//builder.Services.AddCors(options => options.AddPolicy("all", p => p.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader()));

var app = builder.Build();

app.UseDeveloperExceptionPage();

app.UseAuthentication();
app.UseAuthorization();

app.UseWebSockets();

//app.UseRouting();

//app.UseCors("all");

// configure the graphql endpoint at "/Common_Base_Schemas/graphql"
app.UseGraphQL<Common_Base_Schemas>("/Common_Base_Schemas/graphql");

// configure Playground at "/Common_Base_Schemas/ui/playground" with relative link to api
app.UseGraphQLPlayground(
"/Common_Base_Schemas/ui/playground",
new GraphQL.Server.Ui.Playground.PlaygroundOptions
{
GraphQLEndPoint = "../graphql",
SubscriptionsEndPoint = "../graphql",
});

// configure the graphql endpoint at "/IMS_Schemas/graphql"
app.UseGraphQL<IMS_Schemas>("/IMS_Schemas/graphql");

// configure Playground at "/IMS_Schemas/ui/playground" with relative link to api
app.UseGraphQLPlayground(
"/IMS_Schemas/ui/playground",
new GraphQL.Server.Ui.Playground.PlaygroundOptions
{
GraphQLEndPoint = "../graphql",
SubscriptionsEndPoint = "../graphql",
});

app.MapRazorPages();
await app.RunAsync();

Answer 8 · 2023-02-23T01:01:32.000Z

Query.cs：

using GraphQL;

namespace KDRun.Model.GraphType.IMS
{
public class Query
{
[AllowAnonymous]
public static CompanyEntity? companyEntity()
{
return new CompanyEntity() { rowkey = Guid.NewGuid().ToString(), CompanyId = "11", CompanyName = "12" };
}

    [Authorize(Policy = "111")]
    public static IEnumerable<CompanyEntity>? companyAll()
    {
        return new CompanyEntity[] { new CompanyEntity() { rowkey = Guid.NewGuid().ToString(), CompanyId = "A11" } };
    }

}

Answer 9 · 2023-02-23T02:17:45.000Z

I just realized what the issue is. Your authorization policy does not require the user to be authenticated, as it always returns Success. However, in our authorization attribute, we implicitly require the user to be authenticated before policies or roles are checked. See here:

https://github.com/graphql-dotnet/graphql-dotnet/blob/master/src/GraphQL/Attributes/Authorization/AuthorizeAttribute.cs#L41..L110

And here:

https://github.com/graphql-dotnet/graphql-dotnet/blob/master/src/GraphQL/Extensions/AuthorizationExtensions.cs#L124

And here:

https://github.com/graphql-dotnet/graphql-dotnet/blob/master/src/GraphQL/Extensions/AuthorizationExtensions.cs#L158

And here:

https://github.com/graphql-dotnet/graphql-dotnet/blob/master/src/GraphQL/Extensions/AuthorizationExtensions.cs#L190

And here:

https://github.com/graphql-dotnet/graphql-dotnet/blob/master/src/GraphQL/Extensions/AuthorizationExtensions.cs#L83

This was implemented as an optimization so that policies need not be checked if the user is not authenticated in the first place. This may differ from ASP.NET Core's logic.

We can consider changing this in a future version of GraphQL.NET if you can provide reasoning why this should not be the case.

To change behavior in the current version of GraphQL.NET, you would need to:

Inherit from AuthorizationVisitor and override ValidateAsync so it calls a custom implementation of IsAuthorizationRequired which only returns provider.GetMetadata(AUTHORIZE_KEY, false). See https://github.com/graphql-dotnet/server/blob/master/src/Transports.AspNetCore/AuthorizationVisitorBase.Validation.cs#L74
Inherit from AuthorizationValidationRule so it uses your custom AuthorizationVisitor implementation
Call .AddValidationRule<MyAuthorizationValidationRule>() instead of .AddAuthorizationRule()
Write a custom AuthorizationAttribute which sets the metadata directly instead of calling AuthorizeWithPolicy and AuthorizeWithRole.
Use the custom attribute on your methods.

Answer 10 · 2023-02-23T02:20:29.000Z

Another option is to use the authorization project. There are some limitations, such as AllowAnonymous and roles not being supported, but was designed to be able to be implemented without ASP.NET Core's authorization framework. I'm pretty sure it ignores the AUTHORIZE_KEY metadata (currently), and so would just run any policies through your implementation. In the future we may update the code to have the same logic as the one in this project, at which time it would not work for you anymore.

Answer 11 · 2023-02-23T02:30:57.000Z

Another option would be to derive from AuthorizationValidationVisitor, and override IsAuthenticated to always return true. This is very simple to implement, so long as you have a policy or role defined for each method requiring authorization (and not just [Authorize]). Of course methods not requiring authentication would continue to work as intended.

Answer 12 · 2023-02-23T02:37:32.000Z

Here is a sample of the latter:

public class MyAuthorizationVisitor : AuthorizationVisitor
{
    public MyAuthorizationVisitor(ValidationContext context, ClaimsPrincipal claimsPrincipal, IAuthorizationService authorizationService)
        : base(context, claimsPrincipal, authorizationService)
    {
    }

    protected override bool IsAuthenticated => true;
}

public class MyAuthorizationRule : IValidationRule
{
    public virtual async ValueTask<INodeVisitor?> ValidateAsync(ValidationContext context)
    {
        var user = context.User
            ?? throw new InvalidOperationException("User could not be retrieved from ValidationContext. Please be sure it is set in ExecutionOptions.User.");
        var provider = context.RequestServices
            ?? throw new MissingRequestServicesException();
        var authService = provider.GetService<IAuthorizationService>()
            ?? throw new InvalidOperationException("An instance of IAuthorizationService could not be pulled from the dependency injection framework.");

        var visitor = new MyAuthorizationVisitor(context, user, authService);
        // if the schema fails authentication, report the error and do not perform any additional authorization checks.
        return await visitor.ValidateSchemaAsync(context) ? visitor : null;
    }
}

builder.AddValidationRule<MyAuthorizationRule>();
// remove builder.AddAuthorizationRule()

Answer 13 · 2023-02-23T02:39:09.000Z

Thank you for your reply. In our plan, the authentication framework of .net core is not used. We customize the authentication process and combine it with radis cluster. When the user accesses a specific method, we use the custom authentication to check, that it is legal Let it go, and we will terminate the access if it is illegal.

Answer 14 · 2023-02-23T02:42:47.000Z

Then perhaps you would just take the sample above, and instead of deriving from AuthorizationValidationRule, derive from AuthorizationValidationRuleBase and override all three methods: IsAuthenticated, IsInRole and AuthorizeAsync to fit your needs, skipping the ASP.NET Core authorization framework altogether.

Answer 15 · 2023-02-23T02:45:26.000Z

Sample of the latter:

public class MyAuthorizationVisitor : AuthorizationVisitorBase
{
    public MyAuthorizationVisitor(ValidationContext context)
        : base(context)
    {
        // optional: code to load the identity of the user here
    }

    protected override bool IsAuthenticated => false; // implement your logic here

    protected override bool IsInRole(string role) => false; // implement your logic here

    protected override ValueTask<AuthorizationResult> AuthorizeAsync(string policy)
        => new(AuthorizationResult.Failed()); // implement your logic here
}

public class MyAuthorizationRule : IValidationRule
{
    // this is a singleton so there should be no user-specific code in the constructor

    public virtual async ValueTask<INodeVisitor?> ValidateAsync(ValidationContext context)
    {
        var visitor = new MyAuthorizationVisitor(context);
        // if the schema fails authentication, report the error and do not perform any additional authorization checks.
        return await visitor.ValidateSchemaAsync(context) ? visitor : null;
    }
}

builder.AddValidationRule<MyAuthorizationRule>();

Answer 16 · 2023-02-23T02:51:23.000Z

Please note that if you add transport-level authentication requirements within the options of UseGraphQL, then you need to override the middleware authentication method(s) to tie it to your own implementation. However, you can instead just set an authorization policy on a schema or on the Query or Mutation or Subscription type as appropriate and just use your modified validation rule.

Answer 17 · 2023-02-23T02:55:18.000Z

Thanks for your reply, I'll try it!

Answer 18 · 2023-02-23T03:58:11.000Z

Thank you for your reply,

How to access http headers in Query or Mutation or Subscription method?

and

How to access http headers in MyAuthorizationRule?

thanks.

Answer 19 · 2023-02-23T04:21:00.000Z

Inject IHttpContextAccessor into the constructor of MyAuthorizationRule

Answer 20 · 2023-02-23T04:26:58.000Z

Yes，

public class MyAuthorizationRule : IValidationRule
{
IHttpContextAccessor _httpContext;
public MyAuthorizationRule(IHttpContextAccessor httpContext)
{
_httpContext = httpContext;
}

// this is a singleton so there should be no user-specific code in the constructor

public virtual async ValueTask<INodeVisitor?> ValidateAsync(ValidationContext context)
{
    var visitor = new MyAuthorizationVisitor(context);
    Console.Write(_httpContext.HttpContext.Request.Headers);
    // if the schema fails authentication, report the error and do not perform any additional authorization checks.
    //return await visitor.ValidateSchemaAsync(context) ? visitor : null;
    return null;
}

}

Answer 21 · 2023-02-23T04:35:31.000Z

I’d probably just pass the relevant header(s) into the visitor, but there’s a few ways to implement it. Is it working?

Answer 22 · 2023-02-23T04:37:30.000Z

Yes, nject IHttpContextAccessor into the constructor of MyAuthorizationRule is good.

Answer 23 · 2023-02-23T04:37:42.000Z

Another option is to use the user context builder to initialize the UserContext based on the HttpContext. Then both the validation rule and individual methods have access to it.

Answer 24 · 2023-02-23T04:44:10.000Z

That's a good idea, how to do this：
"Another option is to use the user context builder to initialize the UserContext based on the HttpContext. Then both the validation rule and individual methods have access to it.",

Answer 25 · 2023-02-23T06:00:10.000Z

https://github.com/graphql-dotnet/server#user-context-configuration

Answer 26 · 2023-02-24T03:51:56.000Z

Thank for you.

Answer 27 · 2023-05-23T18:29:47.000Z

Here is a sample of the latter:

public class MyAuthorizationVisitor : AuthorizationVisitor
{
    public MyAuthorizationVisitor(ValidationContext context, ClaimsPrincipal claimsPrincipal, IAuthorizationService authorizationService)
        : base(context, claimsPrincipal, authorizationService)
    {
    }

    protected override bool IsAuthenticated => true;
}

public class MyAuthorizationRule : IValidationRule
{
    public virtual async ValueTask<INodeVisitor?> ValidateAsync(ValidationContext context)
    {
        var user = context.User
            ?? throw new InvalidOperationException("User could not be retrieved from ValidationContext. Please be sure it is set in ExecutionOptions.User.");
        var provider = context.RequestServices
            ?? throw new MissingRequestServicesException();
        var authService = provider.GetService<IAuthorizationService>()
            ?? throw new InvalidOperationException("An instance of IAuthorizationService could not be pulled from the dependency injection framework.");

        var visitor = new MyAuthorizationVisitor(context, user, authService);
        // if the schema fails authentication, report the error and do not perform any additional authorization checks.
        return await visitor.ValidateSchemaAsync(context) ? visitor : null;
    }
}

builder.AddValidationRule<MyAuthorizationRule>();
// remove builder.AddAuthorizationRule()

Thank you. I just wanted to comment that I had the same problem building an internal enterprise application. This particular piece of code solved my problem.

Answer 28 · 2023-05-23T18:55:31.000Z

@sungam3r Perhaps we should not check that IsAuthenticated == true before checking policy or role membership.

Answer 29 · 2023-08-08T09:26:04.000Z

I just ran into the same issue. Setting IsAuthenticated == true solved it, but finding the reason for this behaviour caused some headaches.