Hangfire Dashboard Authorization Config Not working

问题

I've downloaded the nu-get package Hangfire.Dashboard.Authorization

I'm trying configure the OWIN based authorization as per the docs as follows but I get intellisense error DashboardOptions.AuthorizationFilters is obsolete please use Authorization property instead

I also get intellisense error The type or namespace AuthorizationFilter and ClaimsBasedAuthorizationFilterd not be found

using Hangfire.Dashboard;
using Hangfire.SqlServer;
using Owin;
using System;

namespace MyApp
{
    public class Hangfire
    {
       public static void ConfigureHangfire(IAppBuilder app)
        {
           GlobalConfiguration.Configuration
           .UseSqlServerStorage(
               "ApplicationDbContext",
                new SqlServerStorageOptions 
                  { QueuePollInterval = TimeSpan.FromSeconds(1) });

           var options = new DashboardOptions
           {
               AuthorizationFilters = new[]
               {
                  new AuthorizationFilter { Users = "admin, superuser", Roles = "advanced" },
                  new ClaimsBasedAuthorizationFilter("name", "value")
               }
           };

           app.UseHangfireDashboard("/hangfire", options);
           app.UseHangfireServer();
        }
    }
}

* UPDATE *

Since the above nuget package doesnt work I've attempted to create my own custom filter:

public class HangfireAuthorizationFilter : IAuthorizationFilter
{
    public bool Authorize(IDictionary<string, object> owinEnvironment)
    {
        // In case you need an OWIN context, use the next line,
        // `OwinContext` class is the part of the `Microsoft.Owin` package.
        var context = new OwinContext(owinEnvironment);

        // Allow all authenticated users to see the Dashboard (potentially dangerous).
        return context.Authentication.User.Identity.IsAuthenticated;
    }
}

How do I restrict to only Admin roles i.e what is the syntax?

回答1:

You need to make sure the Configure(app) method is called in your Startup.cs class before configuring your hangfire dashboard.

  public partial class Startup
{
    private static readonly ILog log = 
        LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod
    ().DeclaringType);


    public void Configuration(IAppBuilder app)
    {

        //Hangfire Config
        GlobalConfiguration.Configuration.UseSqlServerStorage
            ("HangFireJobs");
        app.UseHangfireServer();

        log.Debug("Application Started");

        ConfigureAuth(app);


        //this call placement is important
        var options = new DashboardOptions
        {
            Authorization = new[] { new CustomAuthorizationFilter() }
        };
        app.UseHangfireDashboard("/hangfire", options);
    }
}

Then in your auth config class you can do something as simple as this :

  public class CustomAuthorizationFilter : IDashboardAuthorizationFilter
{ 

    public bool Authorize(DashboardContext context)
    {
        if (HttpContext.Current.User.IsInRole("Admin"))
        {
            return true; 
        }

        return false; 
    }
}

回答2:

Defining the dashboard options in this way worked for me -

    var options = new DashboardOptions
    {
        AuthorizationFilters = new List<IAuthorizationFilter>
       {
          new Hangfire.Dashboard.AuthorizationFilter { Users = "admin, superuser", Roles = "advanced" },
          new Hangfire.Dashboard.ClaimsBasedAuthorizationFilter("name", "value")
       }
    };

I have imported the following namespaces -

using System;
using Owin;
using Hangfire;
using Hangfire.Dashboard;
using System.Collections.Generic;
using Hangfire.SqlServer;

Yes it is showing me the deprecated warning for AuthorizationFilters and suggest to use Authorization, basically the IAuthorizationFilter interface is going to removed in version 2.0, and IDashboardAuthorizationFilter interface has to be used.

For this you can create your own custom filter implementing IDashboardAuthorizationFilter and use this instead.

public class MyAuthorizationFilter : IDashboardAuthorizationFilter
{
    public bool Authorize(DashboardContext context)
    {
        //Implement
    }
}

来源：https://stackoverflow.com/questions/38890688/hangfire-dashboard-authorization-config-not-working

标签

asp.net-mvc

owin

hangfire