How can I implement policy based authorization with Ocelot?

[tmkhan]

Feature

• Request Aggregation

Actual Behavior

Further, I tried to access claims with HttpContext.User.Identities, but it giving null.

[aliprogrammer69]

i have same problem. i tried to access to Claims with context.User.Claims but it return null.
there was no problem in version 14.0.9 before

[andrei-manulife]

I have the same problem. This has to be a bug. I cannot upgrade until I figure out why this is happening.

[aliprogrammer69]

i checked the source code and found the problem.
this problem accouris because of "MultiplexingMiddleware:46" which this is inevitable. to solve the problem, read authorization infos (identities, claims and etc) from PreAuthenticationMiddleware

[Kation]

i checked the source code and found the problem.
this problem accouris because of "MultiplexingMiddleware:46" which this is inevitable. to solve the problem, read authorization infos (identities, claims and etc) from PreAuthenticationMiddleware

This is bad!!!
If MultiplexingMiddleware DO NOT Passing HttpContext.User, ClaimsToHeadersMiddleware will not work because it will get default ClaimsPrincipal and its claims is empty!

No source.User reference :

Ocelot/src/Ocelot/Multiplexer/MultiplexingMiddleware.cs

Lines 163 to 188 in 3ef6abd

	private HttpContext Copy(HttpContext source)
	{
	var target = new DefaultHttpContext();
	foreach (var header in source.Request.Headers)
	{
	target.Request.Headers.TryAdd(header.Key, header.Value);
	}
	target.Request.Body = source.Request.Body;
	target.Request.ContentLength = source.Request.ContentLength;
	target.Request.ContentType = source.Request.ContentType;
	target.Request.Host = source.Request.Host;
	target.Request.Method = source.Request.Method;
	target.Request.Path = source.Request.Path;
	target.Request.PathBase = source.Request.PathBase;
	target.Request.Protocol = source.Request.Protocol;
	target.Request.Query = source.Request.Query;
	target.Request.QueryString = source.Request.QueryString;
	target.Request.Scheme = source.Request.Scheme;
	target.Request.IsHttps = source.Request.IsHttps;
	target.Request.RouteValues = source.Request.RouteValues;
	target.Connection.RemoteIpAddress = source.Connection.RemoteIpAddress;
	target.RequestServices = source.RequestServices;
	return target;
	}

httpContext.User where create from MultiplexingMiddleware.Copy:

Ocelot/src/Ocelot/Headers/Middleware/ClaimsToHeadersMiddleware.cs

Line 34 in 3ef6abd

var response = _addHeadersToRequest.SetHeadersOnDownstreamRequest(downstreamRoute.ClaimsToHeaders, httpContext.User.Claims, downstreamRequest);

[raman-m]

The bug has been accepted due to ready PR #1462

• #1396 Lost context User in MultiplexingMiddleware #1462

[ggnaegi]

@raman-m we should keep in mind that issue when refactoring the multiplexing middleware. #1826

[raman-m]

@ggnaegi I'd like to prioritize #1462 to merge it before your #1826

[raman-m]

@tmkhan on Dec 17, 2020

Hi! Regarding your question:

How can I implement policy based authorization with Ocelot?

Policy-based authentication can be implemented all time for each regular ASP.NET app mostly for all Ocelot versions. See Microsoft docs:

• Policy schemes in ASP.NET Core
• Policy-based authorization in ASP.NET Core

In version 23.0 we've delivered new Multiple Authentication Schemes feature which allows not grouping schemes but try to authenticate multiple times.
Another approach is definition of custom auth-policy grouping all required schemes and use it for authentication. But such definitions of policies are outside of Ocelot's responsibilities.