Kanject.Identity.Server

Your own authorization server, deployed into your AWS — permissions declared in code, checked at build time, enforced on every request and synced to DynamoDB.

What it does

• Permissions in code — [Module] on a controller, [RequiresPermission] on each action; keys come out as orders.write, granted per group.
• Checked at build time — analyzer rules PERM001–PERM005 fail the build on a guarded controller with no [Module], or a name with spaces or over 50 characters.
• Enforced per request — each guarded action checks the caller's groups against its key and answers 403 before your code runs.
• Synced to DynamoDB — UseServerlessAuthorization() switches authorization on; with SyncPermissions set, every module and its permissions are written at startup.
• A catalogue to build on — GetSystemModulesAsync() lists every module with its permissions, status and last sync, paged.
• Pairs with Identity — implements the same IUserIdentityService contract as Kanject.Identity.

Preview API

Preview — the module is in private beta; the API may change before GA.

using Kanject.Identity.Server.Extensions;​// Register the authorization server.builder.Services.AddAuthorizationServer();​// Switch authorization on. With SyncPermissions set, every module// and its permissions are written to DynamoDB at startup.app.UseServerlessAuthorization();​// Guard an action. Its key comes out as "orders.write".[Module("orders")]public class OrdersController : ControllerBase{    [HttpPost, RequiresPermission("write", "Create and edit orders")]    public IActionResult Create(OrderRequest order) => Ok();}

Related modules