授权总是返回401

Question

I am trying to create a SOA with a web calling rest api but I have authorization problem. AuthenticateUser can get "test" as user and password but in OnApplicationEndRequest returns 401 anyway. What am I missing?

please ask for any extra information, I will do my best.

using IIS Express

ApiController

[Authorize]
public class BookController : ApiController
{
   public object Get()
   {
       return "";
   }
}

REST - Auth Module

namespace REST.Modules
{
    public class BasicAuthHttpModule : IHttpModule
    {
        private const string Realm = "XX WebAPI";

        public void Init(HttpApplication context)
        {
            // Register event handlers
            context.AuthenticateRequest += OnApplicationAuthenticateRequest;
            context.EndRequest += OnApplicationEndRequest;
        }

        private static void SetPrincipal(IPrincipal principal)
        {
            Thread.CurrentPrincipal = principal;
            if (HttpContext.Current != null)
            {
                HttpContext.Current.User = principal;
            }
        }

        private static bool AuthenticateUser(string credentials)
        {
            var encoding = Encoding.GetEncoding("iso-8859-1");
            credentials = encoding.GetString(Convert.FromBase64String(credentials));

            var credentialsArray = credentials.Split(':');
            var username = credentialsArray[0];
            var password = credentialsArray[1];

            if (!(username == "test" && password == "test"))
            {
                return false;
            }

            var identity = new GenericIdentity(username);
            SetPrincipal(new GenericPrincipal(identity, null));

            return true;
        }

        private static void OnApplicationAuthenticateRequest(object sender, EventArgs e)
        {
            var request = HttpContext.Current.Request;
            var authHeader = request.Headers["Authorization"];
            if (authHeader != null)
            {
                var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);

                // RFC 2617 sec 1.2, "scheme" name is case-insensitive
                if (authHeaderVal.Scheme.Equals("basic", StringComparison.OrdinalIgnoreCase) && authHeaderVal.Parameter != null)
                {
                    AuthenticateUser(authHeaderVal.Parameter);
                }
            }
        }

        // If the request was unauthorized, add the WWW-Authenticate header
        // to the response.
        private static void OnApplicationEndRequest(object sender, EventArgs e)
        {
            var response = HttpContext.Current.Response;
            if (response.StatusCode == 401)
            {
                response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\"{0}\"", Realm));
            }
        }

        public void Dispose()
        {
        }
    }
}

WEB

    readonly static string baseUri = "http://localhost:XXXX/api/book/";

    public static void GetBookList()
    {
        string uri = baseUri;
        using (HttpClient httpClient = new HttpClient(new HttpClientHandler { Credentials = new NetworkCredential("test", "test") }))
        {
            Task<HttpResponseMessage> response = httpClient.PostAsJsonAsync(uri, data);
            var x = response.Result.Content.ReadAsAsync<object>().Result.ToJson();
        }
    }

applicationhost.config

        <authentication>

            <anonymousAuthentication enabled="false" userName="" />

            <basicAuthentication enabled="true" />

            <clientCertificateMappingAuthentication enabled="false" />

            <digestAuthentication enabled="false" />

            <iisClientCertificateMappingAuthentication enabled="false">
            </iisClientCertificateMappingAuthentication>

            <windowsAuthentication enabled="true">
                <providers>
                    <add value="Negotiate" />
                    <add value="NTLM" />
                </providers>
            </windowsAuthentication>

        </authentication>

        <authorization>
            <add accessType="Allow" users="*" />
        </authorization>

ApplicationUserManager

    public static ApplicationUserManager Create(IdentityFactoryOptions<ApplicationUserManager> options, IOwinContext context)
    {
        var manager = new ApplicationUserManager(new UserStore<ApplicationUser>(context.Get<ApplicationDbContext>()));
        // Configure validation logic for usernames
        manager.UserValidator = new UserValidator<ApplicationUser>(manager)
        {
            AllowOnlyAlphanumericUserNames = false,
            RequireUniqueEmail = true
        };
        // Configure validation logic for passwords
        manager.PasswordValidator = new PasswordValidator
        {
            RequiredLength = 6,
            RequireNonLetterOrDigit = true,
            RequireDigit = true,
            RequireLowercase = true,
            RequireUppercase = true,
        };
        var dataProtectionProvider = options.DataProtectionProvider;
        if (dataProtectionProvider != null)
        {
            manager.UserTokenProvider = new DataProtectorTokenProvider<ApplicationUser>(dataProtectionProvider.Create("ASP.NET Identity"));
        }
        return manager;
    }

Answer 1

It seems that you do not create an identity for you test user, you return false right away, so if you want to have test@test account (which you should be very careful not to leave for production), then you need to create identity in that case as well.

Lack of identity causes ASP.NET to generate 401 since you have [Authorize] attribute.

Answer 2

You need to create an Identity from the ApplicationUser Object

private async Task SignInAsync(ApplicationUser user, bool isPersistent)
    {
        AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);


        var identity = await pApplicationUserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);


        AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
    }

Answer 3

Two things:

1. Its probably better to set the unauthorized header in the OnApplicationAuthenticateRequest method. So that the same method either authorizes or denies.

2. You need to assign a role to the user. Null roles is not the same as No roles.

     private static bool AuthenticateUser(string credentials) { var encoding = Encoding.GetEncoding("iso-8859-1"); credentials = encoding.GetString(Convert.FromBase64String(credentials)); var credentialsArray = credentials.Split(':'); var username = credentialsArray[0]; var password = credentialsArray[1]; if (!(username == "test" && password == "test")) { return false; } var identity = new GenericIdentity(username); //0 roles not null roles SetPrincipal(new GenericPrincipal(identity, string[]{})); return true; } private static void OnApplicationAuthenticateRequest(object sender, EventArgs e) { var request = HttpContext.Current.Request; var authHeader = request.Headers["Authorization"]; if (authHeader != null) { var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader); // RFC 2617 sec 1.2, "scheme" name is case-insensitive if (authHeaderVal.Scheme.Equals("basic", StringComparison.OrdinalIgnoreCase) && authHeaderVal.Parameter != null) { bool userIsAuthenticated =AuthenticateUser(authHeaderVal.Parameter); //If not authenticated then user is not Authorized. if (!userIsAuthenticated){ addUnauthorizedHeader() } } } } private static void addUnauthorizedHeader(){ response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\\"{0}\\"", Realm)); }