Custom Authorization in MVC

Anupam Singh

5y721.6k21100Article

ASP.NET MVCustomize authentication/authorizationuthorization authenticationVC Authorization

21 Comments

Join the conversation! Your thoughts help the community grow.

sagar deshmukh5y ago
Would you please also explain .. In MVC we store authentication information in Session. Same where we store token's information n web API for next call. Means there are multiple users have multiple tokens. Would you please provide an article for the same. Thank you in Advance.
sagar deshmukh5y ago
Hi Anupam,
Hiren Joshi8y ago
Thank you Nice... superb
Hamid Khan9y ago
Nice..................
Sagar Prakash9y ago
Thank you for the article..I want to know how OnAuthorization method of AuthorizeAttribute is used in CustomAuthorization class.
- Mayur Padhiyar7y ago
  Yes me too. Have you found any articles?
- Oluwadamilola Adegunwa6y ago
  Sagar Prakash & Mayur Padhiyar, what happens is that "OnAuthorization" gets called if "AuthorizeCore" returns true (you can decide whatever you want to happen e.g you might want to authenticated requests to your server or log the time that this happened) & "HandleUnauthorizedRequest" gets called if "AuthorizeCore" return false (you also get to decide what goes there)...good luck!
Michael Owen9y ago
This is nice Article! But what if I don't want to use AuthorizeAttribute ? Here is my version of custom authorization using Sessions : https://www.youtube.com/watch?v=kRcjE4YNXQU
Buddy Lopez9y ago
Hi, if i want to add option "Sign In different User" using the form authentication but you still need to check the windows authentication. How can we implement this? Do you have sample codes? Thanks
Vanama Dinesh9y ago
Hi, how can i get current user and what is context (GetUser.CurrentUser) var user = context.AppUser.Where(m => m.UserID == GetUser.CurrentUser/ please help out with the following
krissh fosterz9y ago
Does everytime time it hits the db to get check authorized user
Brien King9y ago
Is there a way to override the actual [Authorize] attribute or do I need to create the derived class and decorate my views with that name instead? In other words, if all my views are already decorated with [Authorize], can I write something that replaces the normal controller for doing the authorization?
Muhammad Sabri10y ago
Can I get downloadable code?
Piyush Dixit11y ago
Nice articales
Prasad Mangaonkar11y ago
is there any way to implement without using the ASP.NET membership provider for authentication????
Tyler beard11y ago
Is there a way for an integration test to "hit" this custom attribute?
Mohamed Jawad11y ago
This is just what I was looking for. But I am having trouble implementing it. What is the 'context'? What can be the class in my application to create 'context'? Is it the service from which I get all the user info after authentication? Thanks!
Anupam Singh11y ago
let me know if you face any issue with it
Anupam Singh11y ago
Hi vali, thax for your feedback. actually you just need to create a class same as CustomAuthorizeAttribute which is mentioned in above code sample, and use it like [CustomAuthorize(“Administrator”,”Moderator”) ] in your action methods. your business logic should be in : bool AuthorizeCore(HttpContextBase httpContext) method.
vali khan11y ago
Can plz provide the code
vali khan11y ago
Very good article

Introduction

ASP.NET MVC supports various types of Authorization /Authentication that are builtin.

But sometimes we would like to customize it for project requirements.

Before going to the authorization process in depth let's have a look at Authentication and Authorization. Actually there is a bit of a misconception about them.

The following are the differences in short:

Authentication: It is a process of verification that verifies “Who you are” (it confirms that you are a valid (or invalid) user).
Authorization: It is a process of verification that verifies “What to do” (It confirms you are permissible to do (or not to do) that).

In the MVC framework there are filters that execute in sequence. The sequence is:

Authorization Filters
Action Filters
Result Filters
Exception Filters

It's clear that Authorization filters are taking care of authorizing the current user.

How Authorize Attribute Works

If you are using the ASP.NET membership provider for authentication then it's quite easy to use Authorization in MVC. Here is an example.

[Authorize(Users = "anupam,ashwin")]
public ActionResult AddArticle()
{
return View();
}

We can also specify Roles instead of Users.

Defining Custom Attribute for Authorization

The AuthorizeAttribute Class is defined as:

[AttributeUsageAttribute(AttributeTargets.Class|AttributeTargets.Method, Inherited = true,
AllowMultiple = true)]
public class AuthorizeAttribute : FilterAttribute,
IAuthorizationFilter
<>{
public AuthorizeAttribute()
{…}
protected virtual bool AuthorizeCore(HttpContextBase httpContext)
{…}
public virtual void OnAuthorization(AuthorizationContext filterContext)
<>{…}
protected void HandleUnauthorizedRequest(AuthorizationContext filterContext)
<>{…}
.
.
.
}

Note: another method and properties are omitted to keep it simple.

It uses an identity form httpcontext and verifies/validates the user using the AuthorizeCore and OnAuthorization methods.

Implementing Custom Authorization

Now I will put it into practice. I have created a simple CustomAuthorizeAttribute.

A class is derived from the AuthorizeAttribute class (because we need the common behavior of Authentication). I just overrode the 3 base methods CustomAuthorizeAttribute, AuthorizeCore and HandleUnauthorizedRequest.

Here is the code:

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
Entities context = new Entities(); // my entity
private readonly string[] allowedroles;
public CustomAuthorizeAttribute(params string[] roles)
{
this.allowedroles = roles;
}
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
bool authorize = false;
foreach (var role in allowedroles)
{
var user = context.AppUser.Where(m => m.UserID == GetUser.CurrentUser/* getting user form current context */ && m.Role == role &&
m.IsActive == true); // checking active users with allowed roles.
if (user.Count() > 0)
{
authorize = true; /* return true if Entity has current user(active) with specific role */
}
}
return authorize;
}
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
filterContext.Result = new HttpUnauthorizedResult();
}
}

I have used comments to describe the behavior.

Uses

This is a simple example and you can customize the behavior depending on your needs. I am just using Role based authentication in this example.

Here is the Action method to demonstrate how to use our CustomAuthorize attribute.

[CustomAuthorize(“Administrator”,”Moderator”)
public ActionResult AddArticle()
{
return View();
}

Summary

I hope you have enjoyed it.

I will be looking forward to your valuable feedback/comments.