How do I authorise the Hangfire Dashboard via Microsoft Single Sign-On with Angular 12 and ASP.Net Core 5

Question

My application is an Angular 12 application running on ASP.Net Core 5.

I am currently trying to lock down Hangfire so that it will only work for people with the Admin role.

It uses Microsoft Identity to log in - specifically Single Sign-on, set up in Azure.

public void ConfigureServices(IServiceCollection services)
{
...
   services.AddHangfire(x =>
   {
      x.UseSqlServerStorage(sqlServerConnectionString);
   });
...
   services
      .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddMicrosoftIdentityWebApi(Configuration);
...
}


public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
...
   app.UseAuthentication();
   app.UseRouting();
   app.UseAuthorization();

   app.UseHangfireDashboard("/hangfire", new DashboardOptions
   {
       Authorization = new[] {
          new HangfireAuthorisationFilter()
          },
          AppPath = "/"
   });

...
   app.UseEndpoints(endpoints => {
   ...
   });

   app.UseSpa(spa=>{
      ...
   });

}

This works in my dot net core controllers.

All I need to do to get it to work is add the Authorize attribute:

namespace MyAppName.Controllers
{
    [Produces("application/json")]
    [Route("api/MyRoute")]
    [Authorize(Roles="Role1,Role2,Administrator")]
    public class MyControllerController: MyBaseApiController
    {
...
    }
}

But when I want to Authorise in Hangfire, the User object is missing a whole lot of its properties.

Here is the HangfireAuthorisationFilter:

public class HangfireAuthorisationFilter : IDashboardAuthorizationFilter
{

   public HangfireAuthorisationFilter()
   {
   }

   public bool Authorize(DashboardContext context)
   {
      var httpContext = context.GetHttpContext();
      // the next line always fails. The User object is set. The Identity object is set
      // but there are no claims and the User.Name is null. There are also no roles set.
      return httpContext.User.Identity.IsAuthenticated;
   }
}

There is, however, cookie information, containing the msal cookie:

How can I pass authentication information into the Hangfire Authorize method? How can I access the role information so that I can lock it down to just the Admin role? Is there a way I can decode the msal cookie server-side?

Answer 1

Assuming you have an AzureAd configuration block that looks like below:

"AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "[Enter the domain of your tenant, e.g. contoso.onmicrosoft.com]",
    "TenantId": "[Enter 'common', or 'organizations' or the Tenant Id (Obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]",
    "ClientId": "[Enter the Client Id (Application ID obtained from the Azure portal), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]"
}

I think a better approach to avoid manual validation of the token is to change your code to the following:

public void ConfigureServices(IServiceCollection services)
{

   services.AddHangfire(x =>
   {
      x.UseSqlServerStorage(sqlServerConnectionString);
   });

   services
      .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddMicrosoftIdentityWebApi(Configuration);

   services.
       .AddAuthentication(AzureADDefaults.AuthenticationScheme)
       .AddAzureAD(options => Configuration.Bind("AzureAd", options));

   services.AddAuthorization(options =>
        {
            options.AddPolicy("Hangfire", builder =>
            {
                builder
                    .AddAuthenticationSchemes(AzureADDefaults.AuthenticationScheme)
                    .RequireRole("Admin")
                    .RequireAuthenticatedUser();
            });
        });
}


public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
   app.UseAuthentication();
   app.UseRouting();
   app.UseAuthorization();

   app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
            endpoints.MapHangfireDashboard("/hangfire", new DashboardOptions()
            {
                Authorization = Enumerable.Empty<IDashboardAuthorizationFilter>()
            })
            .RequireAuthorization("Hangfire");
        });
 }

To break this down, the following changes have been made:

• Add authentication for AzureADDefaults.AuthenticationScheme so we can create a policy requiring the "Admin" role.
• Add a policy named "Hangfire" that requires the "Admin" role against a user. See the AddAuthorization call.
• Instead of calling UseHangfireDashboard we call MapHangfireDashboard inside UseEndpoints and protect the hangfire dashboard endpoint using our "Hangfire" policy through the call to RequireAuthorization("Hangfire")
• Removal off the HangfireAuthorisationFilter which is not needed and instead we pass an empty collection of filters in the MapHangfireDashboard call.

The key takeaway is that we are now relying on the security provided by the middleware rather than the implementation of IDashboardAuthorizationFilter which comes with huge risk around the token being invalid and/or a mistake is made in the logic.

Answer 2

Ok I have figured out how to decode the msal cookie to get my list of claims and roles, and authorise successfully with Hangfire

using Hangfire.Dashboard;
using System.IdentityModel.Tokens.Jwt;


namespace MyApp.Filters
{
    public class HangfireAuthorisationFilter : IDashboardAuthorizationFilter
    {

        public HangfireAuthorisationFilter()
        {
        }

        public bool Authorize(DashboardContext context)
        {

            var httpContext = context.GetHttpContext();
            var cookies = httpContext.Request.Cookies;
            var msalIdToken = cookies["msal.{your app client id goes here}.idtoken"];
            var token = new JwtSecurityTokenHandler().ReadJwtToken(msalIdToken);
            foreach(var claim in token.Claims)
            {
                if (claim.Type=="roles" && claim.Value == "Admin")
                {
                    return true;
                }
            }
            return false;
        }

    }
}