How can I implement custom authentication/authorization in asp.net MVC without Identity?

Question

I am working on a asp.net MVC 5-solution where I now need to implement authentication and authorization. The solution has a external service managing the "Heavy work" that will take the username and password on every request, and on successfull verification send back a token with the users permissions(roles) which should be matched against Attributes in the controller.

A request to the external service should be made on every request to my solution. How can I implement this in a simple way in my exising asp.net MVC 5-solution? I have looked at Identity and Owin but they feel overly bloated for what Im trying to achieve. I've also found some info about Forms auth, but it seems to be deprecated?

The workflow I have tried with is something like this:

A user request a controller. The controller is marked with an attribute like "Require(Roles="IT")". I implement the IauthenticationFilter and call my service in the OnAuthentication to verify the users request. From the return I will verify that the user is in fact who he says he is and also if he is permitted to enter the said action on said controller.

Any input is appreciated as I'm having a hard time finding solid info on how to implement a custom auth-solution. Is there any best practice?

Thanks!

Answer 1

MVC builds upon ASP.NET's interfaces IPrincipal and IIdentity . If you implement these interfaces, you can tap into the existing [Authorize] / [AllowAnonymous] attribute functionality of MVC and only extend it if you need some functionality other than users/roles.

I won't repeat the implementation here - there are several posts about how to properly implement these interfaces (which should be set in the Application_PostAuthenticateRequest event in ASP.NET/MVC).

• ASP.NET MVC - Set custom IIdentity or IPrincipal
• ASP.NET MVC - Custom IIdentity or IPrincipal with Windows Authentication
• Implementing IPrincipal and IIdentity in MVC with use of custom membership and role provider
• using custom IPrincipal and IIdentity in MVC3
• IdentityReboot - open source example of custom security provider