如何在ASP.NET Core 6 Web API启动后刷新自定义授权策略？

要解决应用启动后刷新授权策略的问题，核心是让授权系统不再依赖启动时固定的策略定义，而是从可动态更新的配置中实时获取规则。以下是具体实现步骤：

1. 定义策略配置模型 #

创建一个配置类，用来映射外部存储的策略-角色关系：

public class PolicySettings
{
    // 键：策略名称，值：该策略要求的角色列表
    public Dictionary<string, List<string>> RoleRequirements { get; set; } = new();
}

2. 绑定动态配置 #

在Program.cs中，将自定义配置提供器拉取的配置绑定到上述模型（假设你的配置节点名为PolicySettings）：

builder.Services.Configure<PolicySettings>(builder.Configuration.GetSection("PolicySettings"));

3. 实现动态授权策略提供器 #

替换默认的IAuthorizationPolicyProvider，让系统每次获取策略时都读取最新配置：

public class DynamicAuthorizationPolicyProvider : DefaultAuthorizationPolicyProvider
{
    private readonly IOptionsMonitor<PolicySettings> _policySettings;
    private readonly IAuthorizationPolicyProvider _fallbackProvider;
    private readonly IMemoryCache _cache;

    public DynamicAuthorizationPolicyProvider(
        IOptionsMonitor<PolicySettings> policySettings,
        IAuthorizationPolicyProvider fallbackProvider,
        IMemoryCache cache) : base(fallbackProvider)
    {
        _policySettings = policySettings;
        _fallbackProvider = fallbackProvider;
        _cache = cache;
    }

    public override async Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
    {
        // 用缓存平衡性能和实时性，可根据需求调整过期时间
        return await _cache.GetOrCreateAsync($"AuthPolicy_{policyName}", async entry =>
        {
            entry.AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5);
            
            var currentSettings = _policySettings.CurrentValue;
            if (currentSettings.RoleRequirements.TryGetValue(policyName, out var roles))
            {
                var policyBuilder = new AuthorizationPolicyBuilder();
                policyBuilder.RequireRole(roles.ToArray());
                // 如果有自定义授权要求，可在此添加：policyBuilder.AddRequirements(new YourCustomRequirement());
                return policyBuilder.Build();
            }

            // 未找到动态策略时，回退到默认提供器的配置
            return await _fallbackProvider.GetPolicyAsync(policyName);
        });
    }
}

4. 注册动态提供器 #

在Program.cs中注册自定义提供器，替换默认实现：

builder.Services.AddSingleton<IAuthorizationPolicyProvider, DynamicAuthorizationPolicyProvider>();

5. 适配自定义授权处理程序（如果有） #

如果你的授权逻辑依赖自定义处理程序，确保它通过IOptionsMonitor获取最新配置，而不是在构造时一次性读取：

public class ElevatedUserAuthorizationHandler : AuthorizationHandler<CustomRequirement>
{
    private readonly IOptionsMonitor<PolicySettings> _policySettings;

    public ElevatedUserAuthorizationHandler(IOptionsMonitor<PolicySettings> policySettings)
    {
        _policySettings = policySettings;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CustomRequirement requirement)
    {
        var currentPolicyRoles = _policySettings.CurrentValue.RoleRequirements.GetValueOrDefault("ElevatedUser");
        if (currentPolicyRoles != null && 
            context.User.Claims.Any(c => c.Type == ClaimTypes.Role && currentPolicyRoles.Contains(c.Value)))
        {
            context.Succeed(requirement);
        }
        return Task.CompletedTask;
    }
}

然后注册处理程序：

builder.Services.AddSingleton<IAuthorizationHandler, ElevatedUserAuthorizationHandler>();

关键说明 #

• IOptionsMonitor会自动感知自定义配置提供器的更新，当外部策略配置变化时，CurrentValue会同步更新
• 缓存机制避免了每次请求都读取配置，可根据业务需求调整缓存过期时间（比如和配置拉取周期对齐）
• 不需要在AddAuthorization中预先注册静态策略，动态提供器会全权处理策略的获取

内容的提问来源于stack exchange，提问作者askids