Asp.Net Authentication Module

Question

I have created an authentication module in ASP.Net but I do not want the logic in the authentication module to be executed if the resource is configured for anonymous access since the logic is expensive.

There are pages that require authentication in the same directory with pages that do not require authentication. I have no control over this. Is there an easy way to determine that a resource is configured to allow anonymous access prior to the URLAuthorizationModule?

Currently, I am doing the following which does "feel" right. Any help would be appreciated.

public static bool AllowEveryone()
        {
            bool rslt = false;

            AuthorizationSection config = (AuthorizationSection)WebConfigurationManager.GetSection("system.web/authorization");
            if (config.Rules != null && config.Rules.Count > 0)
            {

                AuthorizationRule r = config.Rules[0];  //doing this based on implementation of urlauthorization module in reflector...
                if (r.Action == AuthorizationRuleAction.Allow && r.Users.Contains("*"))
                {
                    return true;
                }

                //todo: check for allow anon ? case


            }

            return rslt;
        }

I'm sorry I wasn't clear. The page is already configured per your description. However, I have a custom authentication module. I am trying to exit the module logic prior to knowing the user identity if the page is configured for allow users="*" or allow users = "?" — complexcipher
– complexcipher, Commented Jul 28, 2009 at 15:01

Christian Hayter · Accepted Answer · 2009-07-28 11:52:29Z

2

I'm not sure how your code fits in with the Membership and Role provider system, but have you tried putting per-URL overrides in the web.config file?

<location path="MyAnonymousPage.aspx">
    <system.web>
        <authorization>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>

answered Jul 28, 2009 at 11:52

Christian Hayter

31.2k6 gold badges76 silver badges101 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

complexcipher · Accepted Answer · 2011-09-27 13:04:11Z

0

In a regular ASP.Net site this can be accomplished with the following code:

IPrincipal anonUser = new GenericPrincipal(new GenericIdentity(string.Empty, string.Empty), new string[0]);

bool allowAnon = UrlAuthorizationModule.CheckUrlAccessForPrincipal(requestPath, anonUser, "get");

However, I am having problems getting it to behave as expected in SharePoint.

edited Sep 27, 2011 at 13:04

user142162

answered Aug 3, 2009 at 18:09

complexcipher

1352 silver badges8 bronze badges

Collectives™ on Stack Overflow

Asp.Net Authentication Module

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related