Incorrect policy information on Secured stereotype

[SarperMUTLUBAY]

What happened?

Hi team,
Me again and I'm here with a new issue. According to the Secured stereotype, we can add multiple policies but in fact we can not. .Net default authorization system doesn't support multiple policies and assumes that a comma separated value is a single policy.

For example, if I add 3 separate policies named "Marketing", "Support", "Service" separated by commas, It throws an error with the The AuthorizationPolicy named: 'Marketing,Support,Service' was not found. message

How is This Issue Affecting You?

✅ I have a workaround, but a fix would be ideal (Minor)

What version of Intent Architect are you using?

4.4.0

Additional information

No response

[JonathanLydall]

Hi @SarperMUTLUBAY,

I have checked this for myself and can see that we are indeed generating this incorrectly here, I have logged an issue for us to fix this as soon as possible.

In the meantime it is possible to assign multiple Security stereotypes to the same endpoint in Intent Architect with each only having a single policy, which will allow you to work around this problem.

Our apologies for any inconvenience caused. Please don't hesitate to reach out should you have any comments or questions.

[SarperMUTLUBAY]

Hi @JonathanLydall

If I add multiple policy with multiple attributes user must meet all policies criteria. It does not work like "policy1 or policy2", it works "policy1 and policy2".

[JonathanLydall]

Hi @SarperMUTLUBAY,

According to Microsoft's documentation, multiple attributes will have an AND behaviour:
https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-9.0#apply-policies-to-mvc-controllers

Do you need it to be ANDing or ORing the policies?

[SarperMUTLUBAY]

Hi @JonathanLydall
In the current AuthorizationBehaviour it works as OR. I think it is correct to have the same behavior as Mediatr at the controller level.

[JonathanLydall]

Hi @SarperMUTLUBAY,

As per Microsoft's Documentation, it's not possible to "OR" policies at the controller method level, the only option is to apply multiple authorization attributes which as you said results in an "AND" situation.

If you want to "OR" policies you would need to make a policy per OR policy combination (e.g. Policy1OrPolicy2) and an authorization handler for it which has its own logic to make it behave as an OR.

Will one of the above work for you?