基于ASP.NET Identity与Identity Server的角色权限存储方案咨询

把权限存在角色声明里确实有不少局限：比如声明是扁平结构，大量权限会让数据冗余且难以维护；权限变更需要更新角色的声明集合，操作繁琐；验证时还要解析声明字符串，容易出错。下面是几种更合理的方案，按需选择：

1. 独立权限表+角色权限关联表（推荐复杂系统） #

这是最灵活的方案，适合需要动态管理权限、权限数量较多的场景。

数据库设计 #

新增两个实体表：

• Permissions：存储所有权限定义
• RolePermissions：角色与权限的关联关系（多对多）

// 权限实体
public class Permission
{
    public int Id { get; set; }
    public string Name { get; set; } // 用类似"Order.Create"的命名规范，清晰区分资源和操作
    public string Description { get; set; }
}

// 角色-权限关联实体
public class RolePermission
{
    public string RoleId { get; set; }
    public int PermissionId { get; set; }
    
    // 导航属性
    public IdentityRole Role { get; set; }
    public Permission Permission { get; set; }
}

在DbContext中配置关联关系：

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    base.OnModelCreating(modelBuilder);

    // 配置多对多主键
    modelBuilder.Entity<RolePermission>()
        .HasKey(rp => new { rp.RoleId, rp.PermissionId });

    // 关联角色表
    modelBuilder.Entity<RolePermission>()
        .HasOne(rp => rp.Role)
        .WithMany()
        .HasForeignKey(rp => rp.RoleId)
        .OnDelete(DeleteBehavior.Cascade);

    // 关联权限表
    modelBuilder.Entity<RolePermission>()
        .HasOne(rp => rp.Permission)
        .WithMany()
        .HasForeignKey(rp => rp.PermissionId)
        .OnDelete(DeleteBehavior.Cascade);
}

权限服务实现 #

封装权限查询逻辑，方便后续调用：

public interface IPermissionService
{
    Task<IEnumerable<string>> GetPermissionsForUserAsync(string userId);
    Task<IEnumerable<string>> GetPermissionsForRoleAsync(string roleName);
}

public class PermissionService : IPermissionService
{
    private readonly UserManager<IdentityUser> _userManager;
    private readonly RoleManager<IdentityRole> _roleManager;
    private readonly ApplicationDbContext _dbContext;

    public PermissionService(UserManager<IdentityUser> userManager, RoleManager<IdentityRole> roleManager, ApplicationDbContext dbContext)
    {
        _userManager = userManager;
        _roleManager = roleManager;
        _dbContext = dbContext;
    }

    public async Task<IEnumerable<string>> GetPermissionsForRoleAsync(string roleName)
    {
        var role = await _roleManager.FindByNameAsync(roleName);
        if (role == null) return Enumerable.Empty<string>();

        return await _dbContext.RolePermissions
            .Where(rp => rp.RoleId == role.Id)
            .Join(_dbContext.Permissions, rp => rp.PermissionId, p => p.Id, (_, p) => p.Name)
            .ToListAsync();
    }

    public async Task<IEnumerable<string>> GetPermissionsForUserAsync(string userId)
    {
        var user = await _userManager.FindByIdAsync(userId);
        if (user == null) return Enumerable.Empty<string>();

        var userRoles = await _userManager.GetRolesAsync(user);
        var permissions = new List<string>();

        foreach (var role in userRoles)
        {
            permissions.AddRange(await GetPermissionsForRoleAsync(role));
        }

        return permissions.Distinct();
    }
}

在Identity Server中返回权限 #

通过自定义ProfileService，将用户的权限作为独立Claim返回给客户端：

public class CustomProfileService : IProfileService
{
    private readonly IPermissionService _permissionService;
    private readonly UserManager<IdentityUser> _userManager;

    public CustomProfileService(IPermissionService permissionService, UserManager<IdentityUser> userManager)
    {
        _permissionService = permissionService;
        _userManager = userManager;
    }

    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var userId = context.Subject.FindFirstValue(ClaimTypes.NameIdentifier);
        var permissions = await _permissionService.GetPermissionsForUserAsync(userId);

        // 添加类型为"permission"的Claim，每个权限对应一个Claim
        context.IssuedClaims.AddRange(permissions.Select(p => new Claim("permission", p)));
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        var userId = context.Subject.FindFirstValue(ClaimTypes.NameIdentifier);
        context.IsActive = await _userManager.FindByIdAsync(userId) != null;
    }
}

最后注册服务：

services.AddScoped<IPermissionService, PermissionService>();
services.AddScoped<IProfileService, CustomProfileService>();

2. 基于Identity Server的API Scope/Resource（适合API场景） #

如果你的权限主要和API接口绑定，可以直接复用Identity Server的ApiScope或ApiResource模型，把权限定义为Scope，再给角色分配对应的Scope。

定义API Scopes #

在Identity Server的配置中添加权限对应的Scope：

public static IEnumerable<ApiScope> ApiScopes =>
    new List<ApiScope>
    {
        new ApiScope("order.create", "允许创建订单"),
        new ApiScope("order.view", "允许查看订单"),
        new ApiScope("user.manage", "允许管理用户")
    };

角色关联Scope #

可以通过数据库存储角色与Scope的关联关系，或者在ProfileService中根据角色动态添加Scope Claim：

// 在CustomProfileService的GetProfileDataAsync方法中补充
var userRoles = await _userManager.GetRolesAsync(user);
var scopes = new List<string>();

if (userRoles.Contains("Admin"))
{
    scopes.AddRange(new[] { "order.create", "order.view", "user.manage" });
}
else if (userRoles.Contains("OrderEditor"))
{
    scopes.AddRange(new[] { "order.create", "order.view" });
}

context.IssuedClaims.AddRange(scopes.Select(s => new Claim("scope", s)));

权限验证 #

在API项目中通过Policy验证Scope：

services.AddAuthorization(options =>
{
    options.AddPolicy("OrderCreate", policy => policy.RequireScope("order.create"));
});

在Controller中使用：

[Authorize(Policy = "OrderCreate")]
[HttpPost("orders")]
public IActionResult CreateOrder(OrderDto dto)
{
    // 业务逻辑
}

3. 配置文件映射（适合小型应用） #

如果系统权限少且不需要动态修改，可以直接在appsettings.json中定义角色与权限的映射：

"RolePermissions": {
    "Admin": ["Order.Create", "Order.View", "User.Manage"],
    "Editor": ["Order.Create", "Order.View"]
}

然后封装读取逻辑：

public class PermissionService : IPermissionService
{
    private readonly IConfiguration _config;
    private readonly UserManager<IdentityUser> _userManager;

    public PermissionService(IConfiguration config, UserManager<IdentityUser> userManager)
    {
        _config = config;
        _userManager = userManager;
    }

    public async Task<IEnumerable<string>> GetPermissionsForUserAsync(string userId)
    {
        var user = await _userManager.FindByIdAsync(userId);
        if (user == null) return Enumerable.Empty<string>();

        var userRoles = await _userManager.GetRolesAsync(user);
        var permissions = new List<string>();

        foreach (var role in userRoles)
        {
            var rolePerms = _config.GetSection($"RolePermissions:{role}").Get<string[]>();
            if (rolePerms != null) permissions.AddRange(rolePerms);
        }

        return permissions.Distinct();
    }
}

方案对比 #

内容的提问来源于stack exchange，提问作者xxxyyy