Odtnhj

All my SignalR clients connect using a JWT bearer token. I utilize the [Authorize] attribute in my SignalR Hub.

This token contains a userId which can be used to check if a user has read access on the resource through the resource's users property which contains a List<PuppyUserPermission> that look like this:

public class PuppyUserPermission

 public string userId get; set; 
 public bool read get; set; 
 public bool write get; set; 

The question is: how do I connect the dots here? Ideally, instead of something like

[Authorize]
public class PuppyHub : Hub

 public async Task SendPuppy(Puppy pup)
 
 await Clients.All.SendAsync(pup);
 

I would so something like the following (this is more pseudo code than anything else, as I don't use valid methods):

[Authorize]
public class PuppyHub : Hub

 public async Task SendPuppy(Puppy pup)
 
 var clients = Puppy.users.Where(u => u.read == true);
 await clients.SendAsync(pup);
 

Basically, I'd like to ensure that the clients recieving the Puppy object via SignalR would be authorized users on the resource. Problem is, Clients is just a list of string client IDs, and I'm not sure how to go about tying them to actual users on my Puppy resource.

How do I go about achieving this?

From the beginning, I had the feeling that the answer lay in IUserIdProvider, but I didn't see how that would work for multiple users.

I finally found the answer, but it'll definitely need some cleanup.

First, create your own implementation of IUserIdProvider as follows:

public class MyUserIdProvider : IUserIdProvider

 public string GetUserId(HubConnectionContext connection)
 
 var username = connection.User.Claims.Where(x => x.Type == "THE_CLAIM_YOU_WANT_TO_USE_TO_IDENTIFY_USERS").First().Value;
 return username;
 

Next, register it using DI:

services.AddSingleton<IUserIdProvider, MyUserIdProvider >();

Now, when you want to send events from the server, use DI in your constructor to pull down an instance of your SignalR Hub as per usual:

 private IHubContext<PuppyHub> puppyHub get; 
 public UsersController(IHubContext<PuppyHub> _puppyHub)
 
 puppyHub = _puppyHub;
 

Then, where when you want to tell your clients about the new Puppy:

// ... typical controller code
// assume we have a var, puppy, with a list of authorized users

// use System.Linq to get a list of userIds where the user is authorized to read the puppy
var authorizedUsers = (IReadOnlyList<string>)puppy.users.Where(x => x.permissions.read == true).Select(i => i._id).ToList();

// send the new puppy to the authorized users
await puppyHub.Clients.Users(authorizedUsers).SendAsync("SendPuppy", puppy);

And viola! You have now done resource-based authorization with SignalR.