基于角色的限制不适用于通过AD的ASP.NET MVC表单身份验证

Question

I've got a ASP.NET MVC page that I'd like to secure with a login and not only authenticate against an Active Directory using Forms Authentication , but also grant access only to specific roles.

web.config

<system.web>
    <authentication mode="Forms">
        <forms name=".ADAuthCookie" loginUrl="~/Home/Login" timeout=45 protection="All" />
    </authentication>
    <authorization>
        <allow roles="Admin" />
        <deny users="*" />
    </authorization>
    ...

Controllers

[HttpGet]
public ActionResult Index() {
    return View("~/ng-app/index_template.cshtml");
}

[HttpGet, AllowAnonymous]
public ActionResult Login() {
    return View("~/ng-app/login_template.cshtml");
}

[HttpPost, AllowAnonymous]
public ActionResult Login(LoginDto dto) {
    ... // validate dto & stuff
    FormsAuthentication.SetAuthCookie(loginModel.Username, loginModel.RememberMe);
}

Now, basic protection and general authentication works perfectly. I can log in with my domain account and I don't have access to any other pages as anonymous users. However, I'm somehow unable to restrict access only to a certain role. When I add <allow roles="Admin" /> to the authorization section, it does absolutely nothing. When I additionally add <deny users="*" /> , I lock myself out and even after successful login, the server always returns 302 Found without doing any redirects or serving the actual file.

Answer 1

You should be doing the allowed roles on the controller declaration

So above your actionresult declaration put this above

[HttpGet]
[Authorize(Roles="Admin")]
public ActionResult AuthorizedView() {
    return View("~/ng-app/admin_template.cshtml");
}

This will then do a check to see if the user is in the role declared or not

To declare the roles in the webconfig you could do something like below

<authorizationConfiguration>
  <controllerAuthorizationMappings>
    <add controller="Home" role="GeneralAccess">        
      <!-- Define allowed roles for actions under the Home Controller -->
      <actionAuthorizationMappings>
        <add action="MyTopSecretActionForSuperCoolPeopleOnly" roles="Developer,Manager,Fonzie" />
      </actionAuthorizationMappings>
    </add>
  </controllerAuthorizationMappings>
</authorizationConfiguration>

And here is a link to the site

http://www.ryanmwright.com/2010/04/25/dynamic-controlleraction-authorization-in-asp-net-mvc/

There is far to much for me to bring it into this thread, I will turn it in to a wiki answer when I have 5 minutes