I’ve been making good use of git branches, though I have to say my poor foresight in not knowing authorization was going to be a big task reared its head where I now have a auth (authentication) and an authorization (authorization) branch on my fork. Me and Drew also found out that apparently commits made after a PR is made aren’t automatically added to the PR.

Authorization

Dr. Goadrich made some roles in the Azure backend, though he didn’t do them right first because the example in the textbox misled him, making a role for an admin be name: Admin and value: Everything.Update. Every tutorial I saw was written like [Authorization(Roles = "Admin"], so I was confused when I was debugging why that didn’t work and saw that my role was apparently Everything.Update. We met and he changed all the role values to be the same as the names. Thanks Microsoft?

Important discovery: if the user is logged in, in page models there’ll now be a User object which is an instance of ClaimsPrincipal. From there there’s a Claims property, which spits out a bunch of garbage as a linq key-value list of Type, Value. I say garbage because most of the entries are three letter something-acronyms and the values range from gibberish in hexadecimal to gibberish in hexadecimal with differing alpha case with regular slashes and pluses. Anyway, the entries that matter are preferred_username, name, and roles, which are the email, Last, First name of the user, and the user’s roles (how does it look with multiple roles?). I got that information because I made a /Debug page that prints the user’s claims, which I hope to add more info to as I need it. You’re a peasant if you debug with print statements! (t. peasant)

Because of the confusion before, I decided it would be better to use policies for authorization so I didn’t have to hardcode the roles in each page. Policies turned out to be more annoying, and I eventually switched to just using ClaimsPrincipal.IsInRole(). By the way, [Authorize(Roles = "Admin,Committee,Evaluator")] works as a boolean OR but IsInRole("Admin,Committee,Evaluator") doesn’t. Thanks Microsoft!

Then it was just a matter of getting that IsInRole method to actually work. The tutorial was surprisingly helpful, but still didn’t really explain what was going on. Thus sits these lines now in Program.cs:

// Roles are sent as a "roles" claim.
options.TokenValidationParameters.NameClaimType = JwtRegisteredClaimNames.Name;
options.TokenValidationParameters.RoleClaimType = "roles";

// I don't know what these do.
options.MapInboundClaims = false;
options.ResponseType = OpenIdConnectResponseType.Code;
options.SaveTokens = true;
options.GetClaimsFromUserInfoEndpoint = true;

Do you know what these do?

The page model of /Evaluate doesn’t hardcode the Evaluator property anymore. It selects for an evaluator whose email matches the logged in user’s one, but if it doesn’t find one it creates an evaluator instead. This really should be done whenever someone logs in (for both evaluators and students), but I made an issue for it. It’s kinda weird syncing data from the Microsoft server and our local db: having all the pages work with cookie-based authorization yet we still keep track of a local Rank property on each evaluator, and it’s never actually used anywhere, but I think removing it is probably a mistake.

End

Ultimately it’s in a state now that you can log in/log out, are only shown nav links to pages that you’re allowed to access, in actuality can only access pages you’re allowed to access, and the evaluator in the page model of /Evaluate isn’t hardcoded anymore. I realized that /Review doesn’t actually need per-evaluator authorization so I removed the Evaluator property from its page model.

The next big step is now to work on a student front end to submit packets to, but that’ll be a bit annoying until we can get student accounts for testing. I sent an email to the help desk requesting test accounts so we don’t have to rely on emulating 4 different roles with 3 accounts, 2 of which are actively working on it and need to be able to access every page lol.

On Monday we met and Dr. Goadrich revealed what was the last hurdle to getting authentication to work: use https lol. This had been something that I was annoyed at before, but it was ultimately really simple: do the things in the Microsoft tutorial from Google, but I thought it wasn’t working since I was getting an error trying to access https://localhost:5001. Turns out that dotnet run was just serving http even though my browser wanted https; what worked was deleting the http method in appsettings.json. It took me a long time to realize since I thought if it wasn’t serving https at all the browser would give a 404 instead, but I guess the protocol in the url is only used for the browser’s interpretation of whatever it receives? So authentication works now, and I’m working on fleshing out the implementation in my branch, and I’ve already committed the minimal changes that allow you to log in and log out.

During that meeting I also inquired about a favicon, and Dr. Goadrich made one: the Hendrix shield + bar but with a cross cut out in the middle. When I got home and checked it, the cross was off-center (how could you) so I remade it and made a PR.

Throughout that now on Monday night I had some hiccups with Git. I had been committing everything to main but now I had two changes and remembered Dr. Goadrich saying to make a new branch since PRs apply to entire branches. So I had to reorganize the already existing commits into auth and favicon and also sync main to upstream. Learned (and will hopefully remember) some new commands:

• git reset [file] unstage “file”
• git branch view branches
• git checkout [branch] switch to branch “branch”
• git checkout -b [branch] create branch “branch”

Overall, really happy authentication is working now. Once I finish this all these other things up we can start working on the main essential features that were blocked, like only allowing users of certain privileges into certain parts of the website, or only showing assigned evaluation requests to the one it’s assigned to. At that point we’ll finally have an alpha version. 邁進せいっ!