的WebAPI多重矛盾的途徑 - 驗證的基於

Question

我有擔任了活動的控制器。所述控制器提供路徑GET => /Events將返回活動的陣列。

該控制器可以用於活動到3種不同類型的認證。 Admin，Api和User。

如果請求者被認證爲User我想回到事件對象，但範圍的用戶。例如

class Event { 
public string Title { get; set; } 
} 

class EventView { 
    public string Title { get; set; } 
    public bool RSVPed { get; set; } 
} 

我怎樣才能使這成爲可能在我的控制器 -

[RoutePrefix("Events")] 
class EventsController { 

    [@Authorize(AuthenticationType.Admin, AuthenticationType.Api)] 
    [HttpGet] 
    [Route("")] 
    public async Task<IHttpActionResult> Get() { } 

    [@Authorize(AuthenticationType.User)] 
    [HttpGet] 
    [Route("")] 
    public async Task<IHttpActionResult> Get() { } 
} 

Answer 1

與所有允許的權限一個動作。在您根據授權委託人執行期望行爲的行爲中。

[RoutePrefix("Events")] 
public class EventsController : ApiController { 

    [Authorize(AuthenticationType.Admin, AuthenticationType.Api, AuthenticationType.User)] 
    [HttpGet] 
    [Route("")] //Matches GET => /Events 
    public async Task<IHttpActionResult> Get() { 
     var user = User.Identity; 
     if(user.AuthenticationType == AuthenticationType.User) { 
      //...User specific code 
     } else { 
      //...Admin, API specific code 
     } 
    } 

} 

其他明智的你必須使路線獨特，以免互相沖突。

[RoutePrefix("Events")] 
public class EventsController : ApiController { 

    [Authorize(AuthenticationType.Admin, AuthenticationType.Api)] 
    [HttpGet] 
    [Route("")] //Matches GET => /Events 
    public async Task<IHttpActionResult> Get() { 
     //... 
    } 

    [Authorize(AuthenticationType.User)] 
    [HttpGet] 
    [Route("{id:int}")] //Matches GET => /Events/12345 
    public async Task<IHttpActionResult> Get(int id) { 
     //... 
    } 
}