How do I redirect after authentication in ServiceStack

Question

I've overridden the CredentialsAuthProvider like so:

public override bool TryAuthenticate(IServiceBase authService, string userName, string password)
        {
            //TODO: Auth the user and return if valid login
            return true;
        }

public override void OnAuthenticated(IServiceBase authService, IAuthSession session, IOAuthTokens tokens, Dictionary<string, string> authInfo)
        {
            base.OnAuthenticated(authService, session, tokens, authInfo);

            //User has been authenticated

            //Find the user's role form the DB

            if (roleA)
                //GOTO mypage1

            if (roleB)
                //GOTO mypage2
        }

I perform a simple post to ~/auth/Credentials and while the authentication works and the OnAuthenticated method is called, how do I actually redirect the user to the appropriate page based on a role or something similar?

I tired to do the following in the OnAuthenticated method but it did not have the desired effect:

authService.("/views/customers");

Update using Starter Template (see comment below):

public class CustomCredentialsAuthProvider : CredentialsAuthProvider
    {
        public override bool TryAuthenticate(IServiceBase authService, string userName, string password)
        {
            return true;
        }

        public override void OnAuthenticated(IServiceBase authService, IAuthSession session, IOAuthTokens tokens, Dictionary<string, string> authInfo)
        {
            session.ReferrerUrl = "http://www.msn.com";

            base.OnAuthenticated(authService, session, tokens, authInfo);
        }
    }

And the form to POST:

<form method="POST" action="/auth/credentials">
        <input name="UserName"/>
        <input name="Password" type="password"/>
        <input type="submit"/>
    </form>

Answer 1

The different places where you can set the Url to redirect to during ServiceStack Authentication , in order of precedence are:

1. The Continue QueryString, FormData or Request DTO variable when making the request to /auth
2. The Session.ReferrerUrl Url
3. The HTTP Referer HTTP Header
4. The CallbackUrl in the AuthConfig of the current AuthProvider used

Given these order of preferences, if the request didn't have a Continue parameter, it should use the session.ReferrerUrl , so you could do:

if (roleA) session.ReferrerUrl = "http://myPage1Url";
if (roleB) session.ReferrerUrl = "http://myPage2Url";

Answer 2

mythz,

Good call on making this OSS. :)

You are correct regarding the order of precedence:

1. The Continue QueryString, FormData or Request DTO variable when making the request to /auth
2. The Session.ReferrerUrl Url The HTTP
3. Referer HTTP Header
4. The CallbackUrl in the AuthConfig of the current AuthProvider used

So in my example, I didn't have the Continue QueryString, Form Data or Request DTO variable, and I didn't have the CallbackUrl, and certainly not the Session.ReferrerUrl because this is the first post of the Session.

From AuthService.cs :

var referrerUrl = request.Continue
    ?? session.ReferrerUrl
    ?? this.RequestContext.GetHeader("Referer")
    ?? oAuthConfig.CallbackUrl;

By default referrerUrl will have the Referer header value from the request. And that is what is going to be assigned to the Location header further down the Post method of the AuthService.cs :

if (!(response is IHttpResult))
                    {
                        return new HttpResult(response) {
                            Location = referrerUrl
                        };
                    }

Once authenticated, and the session.ReferrerUrl is set here the response will be sent to the client with the Location property above set to the original referrer, not the value below:

public override void OnAuthenticated(IServiceBase authService, IAuthSession session, IOAuthTokens tokens, Dictionary<string, string> authInfo)
        {
            session.ReferrerUrl = "http://www.msn.com";
        }

It's only on the second POST of the same session will the client navigate to www.msn.com (in this example) because the session has already been populated. I think this:

var referrerUrl = request.Continue
                ?? session.ReferrerUrl
                ?? this.RequestContext.GetHeader("Referer")
                ?? oAuthConfig.CallbackUrl;

Needs to be determined after the call to auth.