Custom Authorization in MVC

Introduction

 

ASP.NET MVC supports various types of Authorization /Authentication that are builtin.

 

But sometimes we would like to customize it for project requirements.

 

Before going to the authorization process in depth let's have a look at Authentication and Authorization. Actually there is a bit of a misconception about them.

 

The following  are the differences in short:

1. Authentication: It is a process of verification that verifies “Who you are” (it confirms that you are a valid (or invalid) user).
2. Authorization: It is a process of verification that verifies “What to do” (It confirms you are permissible to do (or not to do) that).

In the MVC framework there are filters that execute in sequence. The sequence is:

1. Authorization Filters
2. Action Filters
3. Result Filters
4. Exception Filters

It's clear that Authorization filters are taking care of authorizing the current user.

 

How Authorize Attribute Works

 

If you are using the ASP.NET membership provider for authentication then it's quite easy to use Authorization in MVC. Here is an example. 

[Authorize(Users = "anupam,ashwin")]
public ActionResult AddArticle()
{
   return View();
}

We can also specify Roles instead of Users.

 

Defining Custom Attribute for Authorization

 

The AuthorizeAttribute Class is defined as: 

[AttributeUsageAttribute(AttributeTargets.Class|AttributeTargets.Method, Inherited = true,
AllowMultiple = true)]
public class AuthorizeAttribute : FilterAttribute,
IAuthorizationFilter
<>{
public AuthorizeAttribute()
{…}
protected virtual bool AuthorizeCore(HttpContextBase httpContext)
{…}
public virtual void OnAuthorization(AuthorizationContext filterContext)
<>{…}
protected void HandleUnauthorizedRequest(AuthorizationContext filterContext)
<>{…}
.
.
.
}

Note: another method and properties are omitted to keep it simple.

 

It uses an identity form httpcontext and verifies/validates the user using the AuthorizeCore and OnAuthorization methods.

 

Implementing Custom Authorization

 

Now I will put it into practice. I have created a simple CustomAuthorizeAttribute.

 

A class is derived from the AuthorizeAttribute class (because we need the common behavior of Authentication). I just overrode the 3 base methods CustomAuthorizeAttribute, AuthorizeCore and HandleUnauthorizedRequest.

 

Here is the code: 

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
   Entities context = new Entities(); // my entity
   private readonly string[] allowedroles;
   public CustomAuthorizeAttribute(params string[] roles)
   {
      this.allowedroles = roles;
   }
   protected override bool AuthorizeCore(HttpContextBase httpContext)
   {
      bool authorize = false;
      foreach (var role in allowedroles)
      {
         var user = context.AppUser.Where(m => m.UserID == GetUser.CurrentUser/* getting user form current context */ && m.Role == role &&
         m.IsActive == true); // checking active users with allowed roles.
         if (user.Count() > 0)
         {
            authorize = true; /* return true if Entity has current user(active) with specific role */
         }
      }
      return authorize;
   }
   protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
   {
      filterContext.Result = new HttpUnauthorizedResult();
   }
}

I have used comments to describe the behavior.

 

Uses

 

This is a simple example and you can customize the behavior depending on your needs. I am just using Role based authentication in this example.

 

Here is the Action method to demonstrate how to use our CustomAuthorize attribute.

[CustomAuthorize(“Administrator”,”Moderator”)
public ActionResult AddArticle()
{
return View();
}

Summary

 

I hope you have enjoyed it.

 

I will be looking forward to your valuable feedback/comments.