Identity Manager - Authorization

Identity Manager service contains role based authorization system.

Key endpoints

• [GET] https://[HostName]/api/asol/idm/api/v1/Authorization/Roles/Code
  • Gets all valid roles (role code) for the current authorization token.
• [GET] https://[HostName]/api/asol/idm/api/v1/Authorization/AuthorizeByRole
  • Check that the current authorization token is granted access for the role. Don't Check Rights
• [POST] https://[HostName]/api/asol/idm/api/v1/Authorization/Authorize
  • Authorize test of current access token against to Rights and Roles. Data of Rights and Roles managed by Identity manager service for all other services and applications.

Backend Authorization RestAPI (csharp)

Prerequisites

• nuget ASOL.IdentityManager.AspNetCore.Extensions
  • Install-Package ASOL.IdentityManager.AspNetCore.Extensions

⚠️ Breaking change by ASOL.IdentityManager.AspNetCore.Extensions newer than "0.0.1.28446-dev" - seeding roles, RightObjects, Roles and RoleAuthorizations require registration of consuming MetadataAcceptConsumer.

// Consumer registration
services.AddMessaging(config =>
 {
     config.AddConsumers(typeof(MetadataAcceptConsumer).Assembly); 
     ...
 });

// Configuration of receiving MetadataAccept message
cfg.ReceiveEndpoint(serviceName, ep =>
{   
    ep.UseMetadataExchangeAccept(regContext);
    ...
}

Configuration for ASP.NET Core project which hosting your RestAPI

"AuthorizationServiceOptions": {
    "BaseUrl": "https://[HostName]/api/asol/idm",
    "ServiceRole": "<<Your application code>>",
    "ApplicationCode": "<<Your application code>>",
    "ServiceRoleStrictMode": "Exception"
},
"IdentityManagerClientOptions": {
    "BaseUrl": "https://[HostName]/api/asol/idm"
}, 

Dependency injection register SSO authentication services

// Configure ASP.NET Core authentication and authorization and IPlatformAuthorizationService
services.AddIdentityManager(Configuration)
  // enable automatics RestAPI authorizations
  .SetApiAuthorization(opt => {
    // register all public controllers endpoint from your RestAPI hosted in same assembly as Startup class.
    opt.AddAssembly(typeof(Startup).Assembly);    
  });

Configure ASP.NET Core pipeline

// standard ASP.NET Core Routing
app.UseRouting();
// ...
// enable ASP.NET Core authentication
app.UseAuthentication();
// enable IdentityManager authorization middlewares for all RestAPI endpoints
app.UseIdentityManager();
// ...
app.UseEndpoints(endpoints =>
  {
    // ...
    // Enable health endpoints
    //   /health/ready - authorized detailed tests for readyness of service and report necessary information
    //   /health/live  - anonymously only simple tests of service live status
    endpoints.MapPlatformHealthChecks();
  });

Authorization domain model

Built-in authorization definitions

Native application source code contains some definitions about Roles, Rights and Authorization.

Backend

Project	File	Required	Content
*.API project	/metadata/Roles.json	Required	built-in backend roles. Frontend can use these roles in its own authorization definitions and need not define them in its /assets/auth/roles-*.json file
*.API project	/metadata/Rights.json	Optional	Custom right's objects on backend. API right's object define automatically from your controller and controller method source code. This file contains other right's objects.
*.API project	/metadata/RoleAuthorizations.json	Required	Authorization definition between backend roles and Right's objects.

Frontend

File	Required	Content
/assets/menu/side-menu-*.json	Required	built-in frontend side menu definition (right's objects)
/assets/menu/top-menu-*.json	Optional	built-in frontend top menu definition (right's objects)
/assets/menu/side-menu-*.authorization.json	Required	built-in frontend side menu role authorization definition (role - roleauthorization - rights object)
/assets/menu/top-menu-*.authorization.json	Optional	built-in frontend top menu role authorization definition (role - roleauthorization - rights object)
/assets/auth/roles-*.json	Optional	built-in frontend virtual app roles (usefull for virtual app only)
/assets/auth/ui-authorization*.json	Optional	visual tree definition (right's objects)
/assets/auth/ui-roleauthorization*.json	Optional	visual tree role authorization definition (role - roleauthorization - rights object)