Blazor SecurityService.IsInRole() issue

Radzen Studio Blazor Server
1

Hello,

I am attempting to create a Blazor Server application that will secure pages based on two separate security roles, Admins and Users. All accounts will be assigned to one of these roles, but never both. Some pages will be accessible to only Admins, while others will be accessible to both roles.

I have noticed that when I assign both roles to a page's Access property, the page does not show up in the PanelMenu after login. The page can be accessed if you manually enter the page URL in the browser.

The @attribute [Authorize(Roles="")] directive appears to allow the page to be accessed if the logged in account is a member of one on the assigned roles while your SecurityService.IsInRole() implementation appears to require that the logged in account is a member of all of the assigned roles.

Thanks,
baj

2

Hi @baj,

Indeed you are right. We will address that in the next Radzen release.

3

Hi, I've just recently updated to 2.51.2 and the IsInRole method is still not functioning correctly when multiple roles are assigned to a page. Using AD security.

if (!Principal.IsInRole(role))
{
return false;
}

thanks

4

The IsInRole method looks like this:

        public bool IsInRole(params string[] roles)
        {
            if (!IsAuthenticated())
            {
                return false;
            }

            if (roles.Contains("Authenticated"))
            {
                return true;
            }

            return roles.Any(role => Principal.IsInRole(role));
        }

Should work as expected - returns true if the principal is member of any of the provided roles.

5

Agreed, I see that that is the code for Default security. When using AD security it generates what I listed.

6

This is the code for Active Directory security as well. Make sure your SecurityService isn't in the code generation ignore list.

7

I created 2 new simple Blazor projects, 1 using Default security, and the other using AD security. The Default has your code(+), but the AD still shows the original code I posted. No ignore list in use. I've also updated to 2.51.3.

What could cause my install to generate differently than expected?

Default Security
image

AD Security
image

8

You are right! I was looking at the wrong place. We have fixed that problem and you can temporarily address it like this:

  1. Add the SecurityService.cs file to the code generation ignore list
  2. Add using System.Linq;
  3. Replace the IsInRole method with the following code:
         public bool IsInRole(params string[] roles)
     {
         if (roles.Contains("Everybody"))
         {
             return true;
         }

         if (!IsAuthenticated())
         {
             return false;
         }

         if (roles.Contains("Authenticated"))
         {
             return true;
         }

         return roles.Any(role => Principal.IsInRole(role));
     }