JWT.MultipleRoles.md

JWT Multiple Roles Cheatsheet

Put multiple roles to the JWT token claims:

// Package: System.IdentityModel.Tokens.Jwt
JwtSecurityToken token = new JwtSecurityToken(
    issuer: "saar",
    audience: "saar-audience",
    claims: new[] {
        new Claim(ClaimTypes.Role, "Admin") // Usually getting roles from database for the current user
        new Claim(ClaimTypes.Role, "User")  // Now, the second role for user.
    },
    expires: DateTime.UtcNow.AddMinutes(5),
    signingCredentials: new SigningCredentials(
        key: new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Secret)),
        algorithm: SecurityAlgorithms.HmacSha256
    )
);

Authorization

To allow either role to access the resource:

public class ProtectedResourceController : ControllerBase
{
    [Route("protectedInfo")]
    [HttpGet]
    // Allows either User or Admin access.
    [Authorize(Roles = "User, Admin")]
    public IActionResult Get()
    {
        return Ok("You can see this message means you are a valid user.");
    }
}

To require both roles to access the resource:

public class ProtectedResourceController : ControllerBase
{
    [Route("protectedInfo")]
    [HttpGet]
    // Only accepts claims having both Admin and User
    [Authorize(Roles = "Admin")]
    [Authorize(Roles = "User")]
    public IActionResult Get()
    {
        return Ok("You can see this message means you are a valid user.");
    }
}

Video

• JWT Token with RBAC(Role-Based Access Control) in ASP.NET Core WebAPI.

Reference

• https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-6.0#add-role-services-to-identity