public class IdentityBasicAuthentication : IAuthenticationFilter
    {
        public bool AllowMultiple => throw new NotImplementedException();

        public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
        {
            throw new NotImplementedException();
        }

        public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
        {
            throw new NotImplementedException();
        }
    }

config.Filters.Add(new IdentityBasicAuthentication());

public class IdentityBasicAuthentication : IAuthenticationFilter
    {
        public bool AllowMultiple { get; }

        /// <summary>
        /// 请求先经过AuthenticateAsync
        /// </summary>
        /// <param name="context"></param>
        /// <param name="cancellationToken"></param>
        /// <returns></returns>
        public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
        {
            // 1、获取token
            context.Request.Headers.TryGetValues("Authorization", out var tokenHeaders);
            // 2、如果没有token，不做任何处理
            if (tokenHeaders == null || !tokenHeaders.Any())
            {
                return Task.FromResult(0);
            }
            // 3、如果token验证通过，则写入到identity，如果未通过则设置错误
            var jwtHelper = new JWTHelper();
            var payLoadClaims = jwtHelper.DecodeToObject(tokenHeaders.FirstOrDefault(), Config.JWTKey, out bool isValid, out string errMsg);
            if (isValid)
            {
                var identity = new ClaimsIdentity("jwt", "userName", "roles");//只要ClaimsIdentity设置了authenticationType，authenticated就为true，后面的authority根据authenticated=true来做权限
                foreach (var keyValuePair in payLoadClaims)
                {
                    identity.AddClaim(new Claim(keyValuePair.Key, keyValuePair.Value.ToString()));
                }
                // 最好是http上下文的principal和进程的currentPrincipal都设置
                context.Principal = new ClaimsPrincipal(identity);
                Thread.CurrentPrincipal = new ClaimsPrincipal(identity);
            }
            else
            {
                context.ErrorResult = new ResponseMessageResult(Utils.toJson(HttpCode.SUCCESS, new { code = HttpCode.AuthenticationRequired, msg = errMsg }));

            }
            return Task.FromResult(0);

        }

        /// <summary>
        /// 请求后经过AuthenticateAsync
        /// </summary>
        /// <param name="context"></param>
        /// <param name="cancellationToken"></param>
        /// <returns></returns>
        public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
        {
            return Task.FromResult(0);
        }
    }

[HttpPost]
        [Route("login")]
        public IHttpActionResult Login([FromBody] User user)
        {
            if (user != null)
            {
                //如果是张三
                if (user.Name.ToString() == "张三")
                {
                    Dictionary<string, object> dic = new Dictionary<string, object>();
                    dic.Add("userID", "1");
                    dic.Add("userName", "zhangsan");
                    dic.Add("roles","admin");
                    var token = new JWTHelper().Encode(dic, "abcdefg", 30);//dic:个人信息 abcdefg：key 30：过期时间
                    return Json(new MessageModel() { code = (int)HttpCode.OK, msg = "OK", data = token });
                }
                else
                {
                    return Json(new MessageModel() { code = (int)HttpCode.AuthenticationRequired, msg = "登录失败" });
                }

            }
            else
            {
                return Json(new MessageModel() { code = (int)HttpCode.NULL_PARAM, msg = "参数为空" });
            }


        }

        [Route("getuser"), HttpGet]
        public IHttpActionResult GetUser()
        {
            var user = (ClaimsPrincipal)User;
            var dic = new Dictionary<string, object>();
            foreach (var userClaim in user.Claims)
            {
                dic.Add(userClaim.Type, userClaim.Value);
            }
            return Json(new MessageModel() { code = (int)HttpCode.OK, msg = "OK", data = dic });
        }
    }

        /// <summary>
        /// 只有某种角色的用户才有权限访问
        /// </summary>
        /// <returns></returns>
        [Route("onlyadmin"), HttpGet]
        [Authorize(Roles="admin")]
        public IHttpActionResult OnlyAdmin()
        {
            return Ok("仅管理员能访问的请求");
        }
        /// <summary>
        /// 只有某个用户才有权限访问
        /// </summary>
        /// <returns></returns>
        [Route("onlyuser"), HttpGet]
        [Authorize(Users =("zhangsan"))]
        public IHttpActionResult OnlyUser()
        {
            return Ok("仅张三能访问的请求");
        }

 public class RoleAuthorizeAttribute : AuthorizeAttribute
    {
        public string Roles { set; get; }
        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            IPrincipal principal = actionContext.ControllerContext.RequestContext.Principal;
            //首先principal不能为空，且principal.Identity是已经通过身份验证的（即Identity.IsAuthenticated==true）
            //然后验证接口权限是否在角色里
            return (principal != null && principal.Identity != null
               && principal.Identity.IsAuthenticated&&Role_isValid(actionContext));
        }
        protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
        {
            actionContext.Response = Utils.toJson(HttpStatusCode.OK, new { code = HttpStatusCode.Unauthorized, msg = "未授权" });
        }

        /// <summary>
        /// 验证用户角色
        /// </summary>
        /// <param name="actionContext"></param>
        /// <returns></returns>
        protected bool Role_isValid(HttpActionContext actionContext)
        {
            if (Roles!=null)
            {
                var authorization = actionContext.Request.Headers.Authorization;
                JWTHelper jwt = new JWTHelper();
                bool isValid = false;
                var userinfo = jwt.Decode(authorization.Scheme, Config.JWTKey, out isValid, out string errMsg);
                if (isValid)
                {
                    //token转json字符串再转数组
                    Dictionary<string, string> userDict = JsonConvert.DeserializeObject<Dictionary<string, string>>(userinfo);
                    var user_roles = userDict["roles"].Split(',');
                    var need_roles= Roles.Split(',');
                    //判断角色是否在Roles里
                    foreach (var role in user_roles)
                    {
                        if (need_roles.Contains(role))
                        {
                            return true;
                        }
                    }
                    return false;
                }
                else
                {
                    return false;
                }
            }
            else
            {
                return true;
            }
            
        }
    }

        [Route("custom"), HttpGet]
        [RoleAuthorize(Roles  = ("admin,user"))]
        public IHttpActionResult CustomRole()
        {
            return Ok("ok");
        }