Add role-based authorization to MeController

Updated MeController to include role-based authorization by modifying the Get method to accept role settings and return user roles. Added AdministratorOnly and UserOnly endpoints with role-based access. Updated User record to include roles. Extended appsettings.json for role configuration. Adjusted Program.cs for new authorization requirements.

Author: marcominerva

samples/Controllers/ApiKeySample/Controllers/MeController.cs

@@ -1,6 +1,8 @@
 using System.Net.Mime;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using SimpleAuthentication.ApiKey;
 
 namespace ApiKeySample.Controllers;
 
@@ -13,8 +15,27 @@ public class MeController : ControllerBase
     [HttpGet]
     [ProducesResponseType<User>(StatusCodes.Status200OK)]
     [ProducesDefaultResponseType]
-    public ActionResult<User> Get()
-        => new User(User.Identity!.Name);
+    public ActionResult<User> Get(IOptions<ApiKeySettings> apiKeySettingsOptions)
+    {
+        // Get roles using the configured role claim type from options (default is ClaimTypes.Role)
+        var roles = User.FindAll(apiKeySettingsOptions.Value.RoleClaimType).Select(c => c.Value);
+
+        return new User(User.Identity!.Name, roles);
+    }
+
+    [Authorize(Roles = "Administrator")]
+    [HttpGet("administrator")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [EndpointDescription("This endpoint requires the user to have the 'Administrator' role")]
+    public IActionResult AdministratorOnly()
+        => NoContent();
+
+    [Authorize(Roles = "User")]
+    [HttpGet("user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [EndpointDescription("This endpoint requires the user to have the 'User' role")]
+    public IActionResult UserOnly()
+        => NoContent();
 }
 
-public record class User(string? UserName);
+public record class User(string? UserName, IEnumerable<string> Roles);

samples/Controllers/ApiKeySample/appsettings.json

@@ -6,18 +6,23 @@
             // You can specify either HeaderName, QueryStringKey or both
             "HeaderName": "x-api-key",
             "QueryStringKey": "code",
+            //"NameClaimType": "user_name", // Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
+            //"RoleClaimType": "user_role", // Default: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
             // You can set a fixed API Key for authentication. If you have a single value, you can just use the plain property:
             "ApiKeyValue": "f1I7S5GXa4wQDgLQWgz0",
             "UserName": "ApiUser", // Required if ApiKeyValue is used
+            "Roles": [ "Administrator" ],
             // Otherwise, you can create an array of ApiKeys:
             "ApiKeys": [
                 {
                     "Value": "ArAilHVOoL3upX78Cohq",
-                    "UserName": "alice"
+                    "UserName": "alice",
+                    "Roles": [ "Administrator", "User" ]
                 },
                 {
                     "Value": "DiUU5EqImTYkxPDAxBVS",
-                    "UserName": "bob"
+                    "UserName": "bob",
+                    "Roles": [ "User" ]
                 }
             ]
             // You can also combine both declarations.

samples/Controllers/BasicAuthenticationSample/Controllers/MeController.cs

@@ -1,6 +1,8 @@
 using System.Net.Mime;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using SimpleAuthentication.BasicAuthentication;
 
 namespace BasicAuthenticationSample.Controllers;
 
@@ -13,8 +15,27 @@ public class MeController : ControllerBase
     [HttpGet]
     [ProducesResponseType<User>(StatusCodes.Status200OK)]
     [ProducesDefaultResponseType]
-    public ActionResult<User> Get()
-        => new User(User.Identity!.Name);
+    public ActionResult<User> Get(IOptions<BasicAuthenticationSettings> basicAuthenticationSettingsOptions)
+    {
+        // Get roles using the configured role claim type from options (default is ClaimTypes.Role)
+        var roles = User.FindAll(basicAuthenticationSettingsOptions.Value.RoleClaimType).Select(c => c.Value);
+
+        return new User(User.Identity!.Name, roles);
+    }
+
+    [Authorize(Roles = "Administrator")]
+    [HttpGet("administrator")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [EndpointDescription("This endpoint requires the user to have the 'Administrator' role")]
+    public IActionResult AdministratorOnly()
+        => NoContent();
+
+    [Authorize(Roles = "User")]
+    [HttpGet("user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [EndpointDescription("This endpoint requires the user to have the 'User' role")]
+    public IActionResult UserOnly()
+        => NoContent();
 }
 
-public record class User(string? UserName);
+public record class User(string? UserName, IEnumerable<string> Roles);

samples/Controllers/BasicAuthenticationSample/appsettings.json

@@ -8,15 +8,18 @@
             //"RoleClaimType": "user_role", // Default: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
             "UserName": "marco",
             "Password": "P@$$w0rd",
+            "Roles": [ "Administrator" ],
             // Otherwise, you can create an array of Credentials:
             "Credentials": [
                 {
                     "UserName": "alice",
-                    "Password": "Password1"
+                    "Password": "Password1",
+                    "Roles": [ "Administrator", "User" ]
                 },
                 {
                     "UserName": "bob",
-                    "Password": "Password2"
+                    "Password": "Password2",
+                    "Roles": [ "User" ]
                 }
             ]
             // You can also combine both declarations.

samples/MinimalApis/ApiKeySample/Program.cs

@@ -65,11 +65,11 @@
 .RequireAuthorization();
 
 app.MapGet("api/administrator", () => TypedResults.NoContent())
-.WithDescription("This endpoint requires the user to have the 'Administrator' role.")
+.WithDescription("This endpoint requires the user to have the 'Administrator' role")
 .RequireAuthorization(policy => policy.RequireRole("Administrator"));
 
 app.MapGet("api/user", () => TypedResults.NoContent())
-.WithDescription("This endpoint requires the user to have the 'User' role.")
+.WithDescription("This endpoint requires the user to have the 'User' role")
 .RequireAuthorization(policy => policy.RequireRole("User"));
 
 app.Run();

samples/MinimalApis/BasicAuthenticationSample/Program.cs

@@ -65,11 +65,11 @@
 .RequireAuthorization();
 
 app.MapGet("api/administrator", () => TypedResults.NoContent())
-.WithDescription("This endpoint requires the user to have the 'Administrator' role.")
+.WithDescription("This endpoint requires the user to have the 'Administrator' role")
 .RequireAuthorization(policy => policy.RequireRole("Administrator"));
 
 app.MapGet("api/user", () => TypedResults.NoContent())
-.WithDescription("This endpoint requires the user to have the 'User' role.")
+.WithDescription("This endpoint requires the user to have the 'User' role")
 .RequireAuthorization(policy => policy.RequireRole("User"));
 
 app.Run();

src/SimpleAuthentication.Abstractions/version.json

@@ -1,6 +1,6 @@
 {
 	"$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
-	"version": "3.0",
+	"version": "3.1",
 	"publicReleaseRefSpec": [
 		"^refs/heads/master$" // we release out of master
 	],

src/SimpleAuthentication.Swashbuckle/version.json

@@ -1,6 +1,6 @@
 {
 	"$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
-	"version": "3.0",
+	"version": "3.1",
 	"publicReleaseRefSpec": [
 		"^refs/heads/master$" // we release out of master
 	],

src/SimpleAuthentication/version.json

@@ -1,6 +1,6 @@
 {
 	"$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
-	"version": "3.0",
+	"version": "3.1",
 	"publicReleaseRefSpec": [
 		"^refs/heads/master$" // we release out of master
 	],