Attribute-Based Access Control Sample for a .Net Core API Application
Web architect cum developer working in the .NET ecosystem with Azure and having completed many successful projects and products mainly Syncfusion Data Platform - Bold BI and Bold Reports.
Skilled in Full stack web development involving ASP.Net Core MVC, Web API, SQL, jQuery, Scss, Webhooks, Azure, DevOps, TDD, and Agile development.
Implemented a robust and flexible permission management system for an enterprise server application which is the base for Syncfusion's Data Platform - boldbi.com and Syncfusion Report Platform - boldreports.com
GitHub Link: https://github.com/venbacodes/ABAC-Sample-for-API
This is a simple demo sample on implementing ABAC in a .Net Core API Application. This uses three main aspects of Attributes => ACCESS, SCOPE, and MODULE.
Key Points
- Access, Scope, and Module attributes are used
- It is possible to extend this sample to accommodate as many attributes as needed
- No External libraries were used
- Handled all the necessary authn and authz in the handlers itself.
- Optional takeaway - added an additional path for restricting resources in PermissionsAuthHandler.cs#L60
To Explore
- Clone and run the code
- Generate a JWT token with email/sub and exp. Applicable emails can be found in TestUsers.cs
- Add the generated JWT token in the swagger authorization menu and call the APIs
