Incorrect policy information on Secured stereotype

[SarperMUTLUBAY]

What happened?

Hi team,
Me again and I'm here with a new issue. According to the Secured stereotype, we can add multiple policies but in fact we can not. .Net default authorization system doesn't support multiple policies and assumes that a comma separated value is a single policy.

For example, if I add 3 separate policies named "Marketing", "Support", "Service" separated by commas, It throws an error with the The AuthorizationPolicy named: 'Marketing,Support,Service' was not found. message

How is This Issue Affecting You?

✅ I have a workaround, but a fix would be ideal (Minor)

What version of Intent Architect are you using?

4.4.0

Additional information

No response

[JonathanLydall]

Hi @SarperMUTLUBAY,

I have checked this for myself and can see that we are indeed generating this incorrectly here, I have logged an issue for us to fix this as soon as possible.

In the meantime it is possible to assign multiple Security stereotypes to the same endpoint in Intent Architect with each only having a single policy, which will allow you to work around this problem.

Our apologies for any inconvenience caused. Please don't hesitate to reach out should you have any comments or questions.

[SarperMUTLUBAY]

Hi @JonathanLydall

If I add multiple policy with multiple attributes user must meet all policies criteria. It does not work like "policy1 or policy2", it works "policy1 and policy2".

[JonathanLydall]

Hi @SarperMUTLUBAY,

According to Microsoft's documentation, multiple attributes will have an AND behaviour:
https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-9.0#apply-policies-to-mvc-controllers

Do you need it to be ANDing or ORing the policies?

[SarperMUTLUBAY]

Hi @JonathanLydall
In the current AuthorizationBehaviour it works as OR. I think it is correct to have the same behavior as Mediatr at the controller level.

[JonathanLydall]

Hi @SarperMUTLUBAY,

As per Microsoft's Documentation, it's not possible to "OR" policies at the controller method level, the only option is to apply multiple authorization attributes which as you said results in an "AND" situation.

If you want to "OR" policies you would need to make a policy per OR policy combination (e.g. Policy1OrPolicy2) and an authorization handler for it which has its own logic to make it behave as an OR.

Will one of the above work for you?

[JonathanLydall]

Hi @SarperMUTLUBAY,

Just a follow-up that from our side we will be changing the Intent Architect designers to not allow adding of multiple Roles to the "Secured" stereotype since this is actually not supported by ASP.NET Core's security infrastructure and we'll communicate here when that is done.

Do you have any further comments or questions from your side in regard to this?

[SarperMUTLUBAY]

Hi @JonathanLydall
Asp.net security infrastructure supports multiple roles but it does not support multiple policies afaik. It make sense to remove multiple policy adding feature but I don't think it would make sense to remove the ability to add multiple roles.

https://learn.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-9.0

[JonathanLydall]

You're right, my apologies, I made a mistake, I meant to say it doesn't support multiple Policies (it absolutely supports multiple Roles). Our work item is to change the the "Secured" stereotype to only allow a single policy to be applied, but it would absolutely still support multiple roles.

[SarperMUTLUBAY]

Thanks for the clarification and your support :) Let's wait your amazing updates.

[jp-seini]

Hi @SarperMUTLUBAY

An update is available to the Intent.Metadata.Security module (1.0.3-pre.0) to address this issue.

As discussed above, the Secured stereotype will now only allow one Policy to be selected and applied. If multiple policies are required, then multiple Secured stereotypes should be applied to the entity, each one specifying a different policy, which would result in an AND check on validation.

The roles functionality remains unchanged.

Let me know if you have any further questions.