UseAuthorization() needs to be between UseRouting() and UseEndpoints()

[fvanzee]

Since updating to aspnetcore 3.0.101 this error occurs when trying to perform authorization on orchard controllers.

Error message:

Configure your application startup by adding app.UseAuthorization() inside the call to Configure(..) in the application startup code. The call to app.UseAuthorization() must appear between app.UseRouting() and app.UseEndpoints(...).

The 3.0.101 update now requires the UseAuthorization() middleware to be placed between UseRouting() and UseEndPoints().

This is introduced in this PR:
dotnet/aspnetcore#14893

And fixes issue:
dotnet/aspnetcore#14049.

My application requires to have authorization on API controllers which provide CMS content from Orchard.

In my Startup.cs I've configured the orchard middleware as such:

 app.UseOrchardCore(ocb =>
 {
    ocb.UseAuthentication();
    ocb.UseAuthorization();
 });

This worked before the update, but on 3.0.101 throws the error message described above.

This means that technically the middleware should now be placed on this line.
https://github.com/OrchardCMS/OrchardCore/blob/dev/src/OrchardCore/OrchardCore/Modules/ModularTenantRouterMiddleware.cs#L125
Between appBuilder.UseRouting() and appBuilder.UseEndpoints(), but there's no way of doing that right now (that I'm aware of).

I'd assume that OrchardCore will still like to support adding authorization in it's request pipeline. I'm happy to submit a PR for a fix, but I'm not sure what approach for the fix would be here.

[jtkech]

I will follow this one

Are you using the cms, because we call them, e.g UseAuthorization through the OC.Users module startup. Otherwise did you try the following?

        ...
        .AddOrchardCore()
        .Configure(app =>
        {
            app.UseAuthentication();
            app.UseAuthorization();
        });

The above helper has an optional order parameter (0 by default), try first without passing it then maybe a negative value ...

[jtkech]

Yes because we use the configure lambda of UseEndpoints in which we call all modules startup.Configure(), and UseEndpoints call this lambda only after having checked some services, and in startup.Configure() we pass an appBuilder to let modules configure the pipeline.

Note: The OrchardCoreBuilder.Configure() helper mentioned in my previous comment allows to define from the application a startup.Configure() as it would have been defined in a module.

        appBuilder.UseRouting().UseEndpoints(routes =>
        {
            foreach (var startup in startups)
            {
                startup.Configure(appBuilder, routes, ShellScope.Services);
            }
        });

[fvanzee]

Thank you for that quick reply! Sorry for not getting back to you sooner.

This indeed solves the issue I was facing. I wasn't aware of the extension on the OrchardCoreBuilder.
As I can see it's technically creating a new Startup like any other module added to the builder.

The syntax does look a bit strange as it defines a middleware pipeline where you would "normally" be building the service collection. But I could also write a new custom module instead of course, which probably would be nicer anyway.

What I'm trying to achieve is to add a (versioned) API layer to provide authorized readonly user access to content using the IContentManager interface. Would you suggest I create a separate module for these routes? Or would there be a better way to achieve this?

[jtkech]

It depends on the complexity and the level of modularity you want, knowing that the application itself behaves as a module on which you can also add separate features. But yes maybe at least one separate module with maybe separate fatures.

That said we already have modules / features for users, roles and permissions, authentication. We have an OpenId module, the expert is @PinpointTownes, modules for external providers as Google and Facebook. And we have a GraphQL module for APIs, one expert being @carlwoodhouse.

[fvanzee]

Thank you for that advise. I've closed the issue as there is none really anymore. There's several approaches I can consider here. I will need to consider exactly what I need to see what would be best.

Thanks again for helping out!