Hangfire: IDashboardAuthorizationFilter with .Net Core

[imperugo]

Hi,
I'm playing with Hangfire and .NET core and everything seems ok (well done).
I'd like to know how to protect the dashboard for authenticated users.

I'm using IdentityServer with OpenId for the authentication and I'm trying to implement the logic into the my IDashboardAuthorizationFilter.

Unfortunately I didn't find a way to get the HttpContext or the current User.
How can I check if the current user is logged or not into my IDashboardAuthorizationFilter?

Thanks

[marcoCasamento]

I'm using a similar configuration (IdSrv v2). I simply add an AuthorizationFilter[] like:

var authorizationFilters = new IAuthorizationFilter[] 
                                                   { 
                                                       new AuthorizationFilter
                                                       {
                                                           Roles = "MyAuthorizedRole1;MyAuthorizedRole2"
                                                       },
                                                   };
app.UseHangfireDashboard("/path",
                                                   new Hangfire.DashboardOptions()
                                                   {
                                                       AuthorizationFilters = authorizationFilters
                                                   }

and then add those roles to the users that need it in the identityservr admin page (bt I believe what's really matter are the "Roles" of your Principal)

[imperugo]

Hi @marcoCasamento
the problem here is that AuthorizationFilter doesn't exist and the IAuthorizationFilter is deprecated. The new one IDashboardAuthorizationFilter doesn't expose the User into the context so I can't check it (otherwise I don't have roles but claims)

[odinserj]

I've just added extension methods, please see the referenced commit. Meanwhile you can cast the context to AspNetCoreDashboardContext class to get the HttpContext property.

class MyAuthorizationFilter : IDashboardAuthorizationFilter
{
    public bool Authorize(DashboardContext context)
    {
        var httpContext = ((AspNetCoreDashboardContext) context).HttpContext;
        return false;
    }
}

[kroniak]

It works like this:

``` c#
internal class HangfireAuthorizationFilter : IDashboardAuthorizationFilter
{
private readonly string[] _roles;

public HangfireAuthorizationFilter(params string[] roles)
{
    _roles = roles;
}

public bool Authorize(DashboardContext context)
{
    var httpContext = ((AspNetCoreDashboardContext)context).HttpContext;
    var result = _roles.Aggregate(false, (current, role) => current || httpContext.User.IsInRole(role));

    return result;
}

}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{

app.UseHangfireDashboard(options:new DashboardOptions
{
Authorization = new[]
{
new HangfireAuthorizationFilter("admin")
}
});
}
```

[odinserj]

Or you can use the GetHttpContext extension method as well:

public bool Authorize(DashboardContext context)
{
    var httpContext = context.GetHttpContext();
    // ...

[kroniak]

@odinserj where is this extension method?

[odinserj]

Ah, it's in the Hangfire.Dashboard namespace, ReSharper pampered me

[kroniak]

@odinserj which package? I dont see this extension in Dashboard namespace and my Resharper doesnt suggest me.

[odinserj]

Hangfire.AspNetCore 1.6.0, in the AspNetCoreDashboardContextExtensions class.

[kroniak]

@odinserj Его нет там )) вот скриншот

[odinserj]

Hm, it was included only to the Hangfire.Core project, and not to Hangfire.Core.NetStandard. So it exists in net45, but doesn't exist on netstandard1.3. @kroniak, thanks for persistence!

[odinserj]

Fixed in b579546773d8ae57affc8a435954555ab1f23289.

[knopa]

How should be in Hangfire.Core v1.6.2?
How can I get httpContext?

[kroniak]

@knopa Да, он там есть

[knopa]

Хоть стрельни но нет экстеншина для DashboardContext

[kroniak]

@knopa oy, sorry. It is in only in the NETCore project.

https://github.com/HangfireIO/Hangfire/blob/4dec6435fb552364833c359079230ad04fd98e53/src/Hangfire.AspNetCore/Dashboard/AspNetCoreDashboardContextExtensions.cs

[knopa]

@kroniak Any plan for Hangfire.Core?

[kroniak]

@knopa this is to @odinserj

[odinserj]

@knopa, the DashboardContextExtensions was mistakenly named OwinDashboardContextExtensions (please see your screenshot). It has the GetOwinEnvironment method:

ASP.NET/OWIN applications

using Microsoft.Owin; // From the Microsoft.Owin package

public bool Authorize(DashboardContext context)
{
    var owinContext = new OwinContext(context.GetOwinEnvironment());

    // ...
}

ASP.NET Core applications

public bool Authorize(DashboardContext context)
{
    var httpContext = context.GetHttpContext();
    // ...
}

Now it's time to update the documentation :smile:

[knopa]

@odinserj
Thanks, it works with owinContext.Request.User.IsInRole

[fredgate]

The authenticated user is also avilable via the Authentication property :
owinContext.Authentication.User.IsInRole("...")