Add Authentication/Authorisation #13

New issue

Closed

opened 2026-05-23 09:28:57 +02:00 by daniel · 1 comment

daniel commented

2026-05-23 09:28:57 +02:00

Owner

Authentication can be done using the Authentication middleware of asp.net.

Authorisation should be a custom implementation as the asp.net provided one doesn't seem right for this use-case.
A new UserService should be implemented. It receives the authenticated user via a ClaimsPrincipal and maps it to a WBS user. It provides a way to access the user but also a way to check if the currently authenticated user is authorised to do an action. A method of the form HasRight(params Data.Entities.Right[]) is probably the way to go.

Also look into creating a custom AuthorizeAttribute so that we don't have to always inject the UserService to ensure the user is authorised to perform an action. Maybe this can even be combined with PipelineBehaviours from MediatR

It is required that users can authenticate with the app to know who is trying to access it to show the according data. Furthermore, authorisation is also required to ensure users can only access what they are allowed to access. Authentication can be done using the [Authentication middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-10.0) of asp.net. Authorisation should be a custom implementation as the asp.net provided one doesn't seem right for this use-case. A new ```UserService``` should be implemented. It receives the authenticated user via a ```ClaimsPrincipal``` and maps it to a WBS user. It provides a way to access the user but also a way to check if the currently authenticated user is authorised to do an action. A method of the form ```HasRight(params Data.Entities.Right[])``` is probably the way to go. Also look into creating a custom ```AuthorizeAttribute``` so that we don't have to always inject the UserService to ensure the user is authorised to perform an action. Maybe this can even be combined with PipelineBehaviours from MediatR

daniel added the

Kind/Feature

Status

Need More Info

labels

2026-05-23 09:28:57 +02:00

daniel added this to the Development project

2026-05-23 09:28:57 +02:00

daniel added

and removed

labels

2026-05-23 10:10:04 +02:00

daniel self-assigned this

2026-05-23 10:25:21 +02:00

daniel commented

2026-05-30 09:15:31 +02:00

Author

Owner

We want to use Keycloak for authentication and authorisation. Here is a tutorial on how to setup and use Keycloak.
Here is a more modern blog/tutorial from 2026.

The only thing to ensure is, that can easily add new rights or groups/roles as having everything hard coded seems a bit wrong.

We want to use Keycloak for authentication and authorisation. [Here](https://nikiforovall.blog/aspnetcore/dotnet/2022/08/24/dotnet-keycloak-auth.html) is a tutorial on how to setup and use Keycloak. [Here](https://www.milanjovanovic.tech/blog/integrate-keycloak-with-aspnetcore-using-oauth-2) is a more modern blog/tutorial from 2026. The only thing to ensure is, that can easily add new rights or groups/roles as having everything hard coded seems a bit wrong.

daniel referenced this issue

2026-07-11 10:56:08 +02:00

Add authentication and authorisation #14