Enable authentication on OData endpoints (Asp.Net Core Web Api)

Question

I'm struggling with authentication in Web Api project that use OData. I thought that configuring authentication like this:

services.AddODataAuthorization((options) =>
{
    options.ConfigureAuthentication(JwtBearerDefaults.AuthenticationScheme).AddMicrosoftIdentityWebApi(Configuration.GetSection(Constants.AzureAd));
});

will be enough to enable authentication on all requests to OData endpoints. But no matter if token is passed, valid or invalid - api methods are always executed. HTTP 401 (unauthorized) is never returned.

In one of the examples there is an explicit use of HasReadRestrictions method:

customers.HasReadRestrictions()
                .HasPermissions(p => p.HasSchemeName("Scheme").HasScopes(s => s.HasScope("Customers.Read")))
                .HasReadByKeyRestrictions(r => r.HasPermissions(p =>
                    p.HasSchemeName("Scheme").HasScopes(s => s.HasScope("Customers.ReadByKey"))));

Is it mandatory to configure all OData entities like that?

Are you using the [Authorize] attribute on your controllers or methods? — JHBonarius
– JHBonarius, Commented Mar 11, 2021 at 10:49
@JHBonarius yes. In that project I have normal api controllers on which authorization works well. Only OData controllers pass unauthenticated requests. — Grzegorz Kotfis
– Grzegorz Kotfis, Commented Mar 11, 2021 at 11:04

norekhov · Accepted Answer · 2022-03-08 15:11:47Z

1

From my understanding currently you have to specify [Authorize] attribute for all controllers including OData because they're not anyhow different from others. ODataController is derived from ControllerBase.

This is kind of weird because you have to specify the same things twice.

Scheme permissions will be exposed in $metadata endpoint but are not applied automatically. There's an authorization library that solves this thing adding a middleware. But it's in beta stage since 2020 and available only for OData < 8.x.

Now if you need to copy policies in EDM is questionable. For example I need it to be exposed in OpenAPI specification. Up to you to decide if you need them.

answered Mar 8, 2022 at 15:11

norekhov

4,3881 gold badge32 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Enable authentication on OData endpoints (Asp.Net Core Web Api)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related