覆盖授权属性

Question

I have a need to override authorize attribute.

Basically if its an ajax request and the user is not logged in or is not in specified roles then i want to return a JSON. The JSON will tell the caller the reason as not logged in or not in role and needs to return the redirect to url. In case of not signed it, it also needs to give back ReturnUrl.

If its not an ajax request then i want the default processing by Authorize attribute to kick in.

We are using forms authentication and the sign in url and error pages are specified in the web.config file.

Following is my take at it but i am not getting the following right

1. missing roles processing in case of an ajax request

2. in case of not an ajax request (else block), i am redirecting the user to the sign in page. i want the default autorize attribute to kickin in this case

I just need the push in the right direction... tutorial or a blog pointer is all i need to learn and accomplish this....

public class AuthorizePartnerProgramsAttribute : AuthorizeAttribute
    {
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            HttpContext httpContext = HttpContext.Current;


            var url = new UrlHelper(filterContext.RequestContext);

            var request = filterContext.HttpContext.Request;

            if (request.IsAuthenticated == false)
            {

                if (filterContext.HttpContext.Request.IsAjaxRequest())
                {
                    if (request.Url != null)
                        filterContext.Result = CommonUtilities.AddJsonUtf8Encoding(new JsonResult { Data = new { error = true, singinerror = true, message = "Sign in required!", returnUrl = request.UrlReferrer.AbsolutePath.ToString() } });
                    else
                        filterContext.Result = CommonUtilities.AddJsonUtf8Encoding(new JsonResult { Data = new { error = true, singinerror = true, message = "Sign in required!" } });
                }
                else
                {
                    if (request.UrlReferrer != null)
                    {
                        filterContext.Result = new RedirectResult(url.Action("Index", "SignIn", new { Area = "Account",  ReturnUrl = filterContext.RequestContext.HttpContext.Request.UrlReferrer.AbsolutePath.ToString() }));
                    }
                    else
                    {
                        filterContext.Result = new RedirectResult(url.Action("Index", "SignIn", new { Area = "Account"}));

                    }
                }

            }

        }


    }

Here is my second stab at it. I think i am now more confused than before and need help setting it up properly

public class AuthorizeCustomAttribute : AuthorizeAttribute
    {
        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            var request = filterContext.RequestContext.HttpContext.Request;

            if (request.IsAjaxRequest())
            {
                var url = new UrlHelper(filterContext.RequestContext);
                var urlReferer = request.UrlReferrer != null
                    ? request.UrlReferrer.ToString()
                    : String.Empty;
                var signInUrl = url.Action("Index", "SignIn", new { Area = "Account", ReturnUrl = urlReferer });
                var accessDeniedUrl = url.Action("PageAccessDenied", "Error", new { Area = "" });
                if (!request.IsAuthenticated)
                {
                    //not authenticated
                    filterContext.Result =
                        CommonUtilities.AddJsonUtf8Encoding(new JsonResult
                        {
                            Data =
                                new {error = true, singinerror = true, message = "Sign in required!", url = signInUrl},
                            JsonRequestBehavior = JsonRequestBehavior.AllowGet
                        });
                }
            }
            else
            {
                base.HandleUnauthorizedRequest(filterContext);
            }
        }

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            if (httpContext.Request.IsAjaxRequest())
            {
                //Use [AuthorizeCustom(Roles="MyRole1,MyRole2")]
                //or [AuthorizeCustom]
                //roles may not have been applied here

                //checking authentication will be done by the HandleUnauthorizedRequest?????
                //if no roles are specified then it is true = so give access to the resource
                //user may have multiple roles or single role assigned, check and if not in role then return json back. 
                //....
            }
            else
            {
                return base.AuthorizeCore(httpContext);
            }
        }
    }

Answer 1

This helped me setting up mine http://www.dotnet-tricks.com/Tutorial/mvc/G54G220114-Custom-Authentication-and-Authorization-in-ASP.NET-MVC.html

use

 [AuthorizeCustom(Roles = RoleNames.Admin)]

Here is the full working attribute for me without any cleanup.

public class AuthorizeCustomAttribute : AuthorizeAttribute
    {
        #region CONSTANTS

        public const string SectionStemFuture = "StemFuture";

        #endregion


        #region PROPERTIES

        private string Section { get; set; }

        #endregion

        #region Constructor

        public AuthorizeCustomAttribute()
        {
            Section = String.Empty;
        }

        public AuthorizeCustomAttribute(string section)
        {
            Section = section;
        }

        #endregion

        #region Overrides

        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            var request = filterContext.HttpContext.Request;

            var url = new UrlHelper(filterContext.RequestContext);

            /*
            var urlReferer = request.UrlReferrer != null
                ? request.UrlReferrer.ToString()
                : String.Empty;
            */
            var urlReferer = request.Url.PathAndQuery;

            var signInUrl = url.Action("Index", "SignIn", new { Area = "Account", ReturnUrl = urlReferer });
            var accessDeniedUrl = url.Action("PageAccessDenied", "Error", new { Area = "" });

            //overwrite the default sign in URL according to the section
            if (!String.IsNullOrWhiteSpace(Section))
            {
                switch (Section)
                {
                    case SectionStemFuture:
                        signInUrl = url.Action("Index", "StemFutureHome", new { Area = "StemFuture", ReturnUrl = urlReferer });
                        break;
                }
            }


            if (!request.IsAuthenticated)
            {
                //not authenticated
                if (request.IsAjaxRequest())
                {
                    filterContext.Result =
                        CommonUtilities.AddJsonUtf8Encoding(new JsonResult
                        {
                            Data =
                                new {error = true, signinerror = true, message = "Sign in required", url = signInUrl},
                            JsonRequestBehavior = JsonRequestBehavior.AllowGet
                        });
                }
                else
                {
                    //this is not an ajax request
                    if (!String.IsNullOrWhiteSpace(Section))
                    {
                        filterContext.Result = new RedirectResult(signInUrl);
                    }
                    else
                    {
                        //let the base authorization take care of it
                        base.OnAuthorization(filterContext);    
                    }
                }

            }
            else if (!String.IsNullOrWhiteSpace(base.Roles))
            {
                var isRoleError = true;
                var rolesAllowed = base.Roles.Split(',');
                //authenticated and we have some roles to check against
                var user = filterContext.HttpContext.User;
                if (user != null && rolesAllowed.Any())
                {
                    foreach (var role in rolesAllowed)
                    {
                        if (user.IsInRole(role))
                        {
                            isRoleError = false;
                        }
                    }
                }

                if (isRoleError)
                {
                    if (request.IsAjaxRequest())
                    {
                        filterContext.Result =
                            CommonUtilities.AddJsonUtf8Encoding(new JsonResult
                            {
                                Data =
                                    new
                                    {
                                        error = true,
                                        signinerror = true,
                                        message = "Access denied",
                                        url = accessDeniedUrl
                                    },
                                JsonRequestBehavior = JsonRequestBehavior.AllowGet
                            });
                    }
                    else
                    {
                        //here we will need to pass to the access denied
                        filterContext.Result = new RedirectResult(accessDeniedUrl);
                    }
                }

            }

        }

        #endregion
    }