I would go with ClaimsTransformer to get user claims. I just will try to show how to get user claims and to handle authorization for Windows Authenticatin.
First create a ClaimsTransformer class:
public class ClaimsTransformer : IClaimsTransformer
{
// i assume you have a user service in which you get user info via entity framework
private readonly IUserService _userService;
public ClaimsTransformer(IUserService userService)
{
_userService = userService;
}
public async Task<ClaimsPrincipal> TransformAsync(ClaimsTransformationContext context)
{
var identity = ((ClaimsIdentity)context.Principal.Identity);
// ... add user claims if required
var roles = _userService.GetRoles(identity.Name);
foreach(var role in roles)
{
identity.AddClaim(new Claim(ClaimTypes.Role, role));
}
return await Task.FromResult(context.Principal);
}
}
Then use it in Configure method
public void Configure(IApplicationBuilder app)
{
//...
app.UseClaimsTransformation(async (context) =>
{
IClaimsTransformer transformer = context.Context.RequestServices.GetRequiredService<IClaimsTransformer>();
return await transformer.TransformAsync(context);
});
//...
}
Unfortunately User.IsInRole method doesn't work with ClaimsTransformer(if you add role with ClaimsTransformer, IsInRole will be false) so you can't use [Authorize(Roles = "")] with ClaimsTransformer. In this case you can use Claims Based Authorization to handle authotorization.
So finally add below code to ConfigureServices and use Authorize attribute:
public void ConfigureServices(IServiceCollection services)
{
// Add framework services.
services.AddSingleton<IClaimsTransformer, ClaimsTransformer>();
services.AddAuthorization(options =>
{
options.AddPolicy("RequireAdministratorRole", policy => policy.RequireClaim(ClaimTypes.Role, "Administrator"));
});
//...
}
[Authorize(Policy = "RequireAdministratorRole")]
public IActionResult Index() { }
