自定义身份验证以及集成的Windows身份验证

Question

I am using Integrated Windows Authentication in my application so domain users alone can access the application.

After this step, I am doing some additional authentication to check whether that domain user is permitted to access the application (domain user will be added in a database table).

To achieve this, I am doing in the following way. Is this the best practice?? Please advise.

public class CCUKAuthorizeAttribute : AuthorizeAttribute
{
protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var isAuthorized =  base.AuthorizeCore(httpContext);

        var isUserAddedinDB = true; //Code to check whether user is added in DB

        return isUserAddedinDB;
    }
}

Answer 1

What you are trying to do is first check authentication and then check for an authorization rule(can he access application). I guess this is a onetime check which happens only during the first time authentication process. In that case you better separate that logic into a different method (Separation of Concerns).

Generally in a MVC application if you need to do a custom Authorization check, I would recommend to do Authorization check by overriding "Authorize" attribute ( example ).