How authorize user at the application level after a successfully authentication in the identity server 4

Question

I have two separate SPA web applications, one for AR invoicing and the second is for AP invoicing. Each application has its database that contains the list of users allowed to use the application. Each application has its ASPNET core web API that it uses to interact with its database. Both applications are using the same Identity server to authenticate the users and give authorizations to use the applications’ API resources. My issue is to find the best way to implement user permission on both applications. I should only allow users that are successfully authenticated in the IDP to access AR invoicing application only if they exist in the User table of this application and the same thing for the AP invoicing application. I know I could add a claim at the identity server to distinct users that belong to the AR invoicing application and the users belong to the AP invoicing, but I think this is not the best implementation since adding this kind of info is not part of the user identity. I’m thinking to override the authorize attribute or add a policy to check if the user is authenticated and exist in the requested application, but this approach will require the application to check the application’s user table for each API call. Could you please advise or redirect me to any tutorial that handles this kind of need.

Answer 1

If you have an Identity Server instance, you can integrate ASP.NET Identity into it easily. Then, in your APIs (resources) you wouldn't need user tables at all - the controllers will automatically have a User instance available after authorizing against the Identity Server. This User is a ClaimsPrinciple that is essentially a collection of claims you can check.

EDIT: Providing more detail on answer.

You mentioned that "Each application has its database that contains the list of users allowed to use the application". My point was that you could have the entire set of users for both applications reside only in the Identity Server's database. This would enforce separation of concerns - the AR/AP apps would only be concerned with AR/AP tasks, while the Identity Server would be concerned with users and authentication/authorization. There is really no need for the AR/AP apps to know any user details - they should just add Authorize attributes and assume that, if a user is able to enter a given endpoint, that user has been properly authorized.

Now, you will need to appropriately build how each app will be authorized. This can be done using claims, roles, or even policies (a way to combine both, and add more advanced authorization logic). For example, you can add this to the AP app when configuring services:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
    services.AddAuthorization(options =>
    {
        options.AddPolicy("CanCreateInvoice", policy =>
        {
            policy.RequireClaim("CreateInvoice");
            policy.RequireRole("Admin");
            policy.RequireUserName("user1");
            ⋮
        });
        ⋮
    });
}

Then you can add this to an AP app endpoint:

public class InvoiceController : Controller
{
    [Authorize(Policy = "CanCreateInvoice")]
    public IActionResult CreateInvoice()
    {
        // Assume the user meets your policy requirements
        // Create the invoice
    };
}

This way, the AP app has no need to be concerned with any user details - it only performs AP-related tasks. If you need to add the id of the user to the created invoice, you may do something like:

invoice.CreatedBy = User.FindFirst("sub").Value;