Adding Roles to the API - A TimCo Retail Manager Video

In this video, we are going to be limiting who can do what by adding in user roles. This will prevent just anyone from using our register and it will allow us to further lock down the endpoints we just created to only administrators.
** TimCo source code now at: www.iamtimcore...
Full Courses: www.iamtimcore...
Mailing List: signup.iamtimc...
One-off tutorials are awesome but they aren't the only thing you should be doing to learn C#. Another vital part of learning is learning how to put it all together. This interactive course is all about putting the pieces together. You can watch each video on its own or you can watch them in order and see a bigger picture. The choice is yours.
This course focuses on real-world development. As such, we are simulating that we work for TimCo Enterprise Solutions on a brand new product, the TimCo Retail Manager. Just like in the real world, we are starting out with one set of requirements but know that over time they will change.

[@torrvic1156]

Thank you so much for valuable advices Mr. Corey! Didn’t knew how to differentiate this roles requirements before with operators like OR or AND regards to authorisation.

[@IAmTimCorey]

I am glad it was helpful.

[@benthornhill9106]

Great video! Thanks for taking the time to teach basic principles as you go along.

[@IAmTimCorey]

Glad it was helpful!

[@andresbeltran5779]

Great video, i learn a little more about roles and permissions, thx

[@IAmTimCorey]

Glad it was helpful!

[@villesipola]

What a great video! Powerful and yet simple to use stuff with those roles. Without knowing what topics there are yet to be covered in the rest of the episodes in this series, i hope there will be a episode where those plain typed roles get converted to enums for ease of use. Thanks Tim! Let the binge watching continue =>

[@IAmTimCorey]

Glad you enjoyed it!

[@harag9]

As always you are Tim Corey, and as always, another great episode. Thanks Tim!

[@IAmTimCorey]

Thank you!

[@ale-cx8vp]

Thank you Tim, an incredibly useful tutorial. To my mind, getting rid of magic strings could be pretty worthwhile.

[@IAmTimCorey]

Thanks for the input.

[@harag9]

@@IAmTimCorey I agree, would love to see a better solution without all the magic strings, I see loads of typos happening...

[@drambooi7169]

Hi Tim - amazing video as always! A question: instead of using a GUID for the role ID, could you just assign an ID like '1', '2', '3' etc.?

[@IAmTimCorey]

The RoleID, UserID, and other items in the security database come from the Microsoft Identity system. That is how they are designed. Changing from a GUID to an int would require overriding how that entire system works, and I don't want to get into that.

[@simon_smale]

Awesome content as always. Please show how to remove the magic strings. I like the enum idea. I think one role per thing and then one user has many roles. Can you make these more granular like permissions. A user can have read or write or different levels of admin?

[@IAmTimCorey]

You can remove these strings but I typically find that it isn't necessary if you are doing your permissions correctly. Roles should be rather big categories, not really specific. For those you want to take what you already know and dial it in even further (so identify which users can write and then do a check for that rather than creating a role for that).

[@SuperDre74]

Thanx for the informative video

[@IAmTimCorey]

You are welcome.

[@johanhansson2531]

Hi Tim! I have a short question, why aren't you using the EF database instead of making your own? If i want to register a user in WPF UI... first i have to add user to EF database and then fetch the ID and then insert into User-table in TRM database. Is that correct or I missing something?

[@IAmTimCorey]

Two reasons - first, I like separating my security from my data. That allows me to be more granular with my database permissions. Second, I prefer not to use EF, especially not in production. It takes a lot to get right. I prefer to dial things in more closely with Dapper/SSDT so that I have the best possible performance.

[@hchoi84]

Hi Tim! First of all, thank you for all the contents. I've been following you on KZbin as well as courses on your site. Gave me more than enough to do this year during the pandemic. To my question, I've been using Claims and this is my first time seeing Roles in action. Roles seem to be easier to implement compared to Claims (I would create policy on startup.cs and use that throughout the project). I also searched your KZbin channel with the keyword "Claims" and didn't see anything. I'm curious if you may have any information on the difference between Claims and Roles; security, small vs large project, flexibility, etc.

[@IAmTimCorey]

I haven't covered the differences but I will add that to the suggestion list.

[@andywalter7426]

One suggestion i have when you eventually do the web views in aspnet core is to use server side blazor. Since that is for sure being released in production later in september 2019.

[@99MrX99]

Also would really like it, if we would use blazor for that.

[@IAmTimCorey]

That suggestion is on the list. I'm considering where to put it. Thanks!

[@ilkansuslu1814]

Great Content. Hey Tim can you make a video "What have we done so far?(TimCo Retail Manager Video Serie)"

[@IAmTimCorey]

I can add that to the suggestion list. Thanks!

[@kayyelle]

Thank you Tim for the informative video. Could you kindly show us how not to use the magic string for the role name ? Just a thought ... is it possible to create the user role authorization part as a reusable component ? Because when other new projects, need the user role authorization function, instead of keep repeating ourselves by creating the code for user authorization, we can reuse by plugging in the user role component, do a few configurations and we are good to go.

[@IAmTimCorey]

Thanks for the vote. As for creating a reusable component, it already is. The part that isn't reusable is what changes per project.

[@kayyelle]

@@IAmTimCorey Thank you for your reply. Oh, I didn't know that. Always learning something new from you (^_^)v

[@scottsaccenti]

I've caught up! Now I have to wait like everybody else for the next drop :)

[@IAmTimCorey]

Nice work catching up.

[@elchureee]

Great content!!

[@IAmTimCorey]

Thanks!

[@RonitGhosh]

How many more videos do you plan to have in this course?

[@IAmTimCorey]

I don't have a total in mind. I plan on continuing to grow and morph this project. There may be a time when we start over but I doubt it. The goal here is to create a real-world simulation of a business application. When you get hired into a job, you usually start working on an existing, complex system. That's hard to find tutorials on. This application is that tutorial. You can practice starting in the middle and getting up to speed.

[@efimov90]

IAmTimCorey, actually commit description isn't enought descriptive, because in this commit you delete ValuesController. So maybe it will be better to separate this into separate commit?

[@IAmTimCorey]

Probably. I shortcut these a lot because of being on video.

[@StudentCompanion]

Thanks Tim, great tutorial as always. Can this same method of [Authorize] of Roles be used with a WinForm application with no Controllers like a WPF application? What's the simplest way to achieve this with a winForm? Thanks.

[@IAmTimCorey]

That comes from ASP.NET. There might be a way to add something for authorization into WinForms directly, but I've not done it. Your best bet would be to do like we are doing and add an API in the middle and handle the authorization there.

[@StudentCompanion]

@@IAmTimCorey ok. Thanks

[@onyebuchiboss]

Hi Tim, I hope you havent forgotten, but when we started this App, you manually copy and pasted the user Id from the EF user table into the User table of the SSDT table. Do you intend on making that process automated at some point?

[@IAmTimCorey]

You will see an update for that this week in the .NET Core upgrade. We will clean it up a bit but it is the start of what you are asking for.

[@andywalter7426]

I have a question. Do you know if its possible to do authorization and rules if a person chose to use sql lite instead of sql server. Because since this is a web site and it has to be hosted on azure, then they would have to use sql server which the cheapest option is 5 dollars per database. If a company does not have the money for that and wanted to use sql lite, hopefully that is possible. Otherwise, they would be forced to create their own security system and have the data in sql lite.

[@IAmTimCorey]

The new .NET Core templates allow you to choose SQLite as your database as an alternative to SQL Server so yes, you can do that. However, I would caution you on the pricing issue. If a company does not have $5/month to spend on data, they don't really have the money to have data. Just because SQLite is free doesn't mean it is truly free. You now need to make sure you are doing regular backups and maintenance on it. You also need to make sure you update the SQLite version whenever a security fix comes out. Basically, you should be doing a few hours of "extra" work each month in exchange for using the "free" SQLite. Using SQL hosted by Microsoft offloads a lot of that work onto Microsoft. You are paying $5/month for better redundancy, better server security, and better maintenance. Just ignoring all of that work with your SQLite database is an option but then you are risking your company's data. That's a pretty big factor in data breaches and in catastrophic issues at companies - they ignored the regular maintenance of their data.

[@timothywestern6488]

There is also Still SQL Server on Premise, but you pay a yearly license Fee I think. MS May be trying to Phase this out Soon though.

[@mohamaddjelouah9332]

thank u tim keep up ue the best

[@IAmTimCorey]

Thank you!

[@objectaware5296]

I noticed the [Route] attribute decorating the actions but I don't see the routes.MapMvcAttributesRoutes(); in RouteContig.

[@IAmTimCorey]

It is in the WebApiConfig.cs file (actually MapHttpAttributeRoutes).

[@mihaimyh]

How about claims/policies? Isn't that a better implementation?

[@IAmTimCorey]

Claims can be more granular but I don't think we need that complexity here. Roles are a great way to go to keep things simple and easy to manage.

[@musings2134]

Hey Tim, this is really important to me. Could you please explain how could we do this if we are you using Entity Framework? I am thinking , may be create an action filter to do so? How would you do it?

[@IAmTimCorey]

I assume you mean Entity Framework. That is what the Identity server uses Entity Framework and that is what I am using. We do more Entity Framework specific work later on in the series.

[@musings2134]

@@IAmTimCorey Oh I am sorry! I meant " if we are NOT using Entity Framework?" I love the way asp.net identity lets you neatly manage role based authorizations by just adding an annotation at the top of your controller method. But what if you are not using entity framework? What if you are using ADO.NET with ASP.NET Core API? How do you manage Role Based Authorization? I am thinking may be a CustomActionFilter could do the trick?

[@gustavobreunig3369]

Thank you Tim. Where can I find the code of Authorize class helper?

[@IAmTimCorey]

Authorize is built into C#. It isn't something I built.

[@gustavobreunig3369]

@@IAmTimCorey ok. Thank you

[@moch.ikhsanafandi4395]

thank you sir, do you have crud .NET Framework video? im learning from my co worker code. but i need basics on how crud, mvc and ajax/jquery works. we have existing db using stored procedure for transactional. currently, its all way above my head haha

[@IAmTimCorey]

Sure, I have a few. Start with this one though: kzbin.info/www/bejne/e6WVnJt9o9d8p8U

[@chetanagarwal461]

How to do the same thing with .net core API with mongodb ?

[@IAmTimCorey]

You can't use the Microsoft authentication system with MongoDB.

[@harag9]

@@IAmTimCorey Q) Is the MS Authentication system only available in EF? If not what else?

[@IAmTimCorey]

In theory, you can rip out the EF and use your own data access. In practice, it is a paid to do and not worth the effort.