AuthorizeAttribute处理有效的授权用户

Question

I have a implemented a custom AuthorizeAtrribute class

public class AdminAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        base.HandleUnauthorizedRequest(filterContext);
    }
} 

Action method

[AdminAuthorize(Roles = "Admin")]
public ViewResult AdminOnly()
{
    return View();
}

[AdminAuthorize(Roles = "Admin, Mod")]
public ViewResult Index()
{
    return View();
}

When I have a user that IsAuthenticated but not in the Admin role I would like to redirect them to the Index page and not the logon page.

I've read the many other SO posts on this but my HandleUnauthorizedRequest() method is not firing.

Answer 1

You are overriding a method that is later in the process than you think. You'll need to override one of these methods to implement your auth logic:

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);

        //do custom work here
    }

OR

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (!base.AuthorizeCore(httpContext))
            return false;

        //do custom work here
    }

Answer 2

this the code i always use when i work with active directory

public string Groups { get; set; }

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    if (base.AuthorizeCore(httpContext))
    {
        if (String.IsNullOrEmpty(Groups)) { return true; }

        var groups = Groups.Split(',').ToList();

        var context = new PrincipalContext(ContextType.Domain,"yourDomain");

        var userPrincipal = UserPrincipal.FindByIdentity(context,IdentityType.SamAccountName,httpContext.User.Identity.Name);

        foreach(var group in groups){ // this will check user if the right role in active directory
            if(userPrincipal.IsMemberOf(context, IdentityType.Name, group)){
                return true;
            }
        }
    }

    return false;
}

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
    if (filterContext.HttpContext.User.Identity.IsAuthenticated)
    {
        var result = new ViewResult();
        result.ViewName = "NotAuthorized";
        result.MasterName = "_Layout";
        filterContext.Result = result;
    }
    else
    {
        base.HandleUnauthorizedRequest(filterContext);
    }
}

forgot to tell the Groups variable represent the field inside my Attribute

[AuthorizeAD(Groups = ConstantsADGroups.AdminGp)]