ASP.NET IIS user role authentication

Question

I'm currently working on a ASP.NET MVC4 website. And in that website i wan't users that are part of an certain role to be allowed to run the code. I use the following code:

    [Authorize(Roles = GROUP)]
    public void Auth()
    {
        /* if user is in the domain and signed in
         * and a member of the above group 
         * they will come here */

        username = User.Identity.Name;

        //Do somthing
    }

And this works great, but when the user isn't part of the domain and/or group it wil prompt for username and password. Is it possible to skip the prompt and just redirect that user?

This website is setup in a IIS 8 with authentication set to windows authentication

Yes, in a IIS 8 with authentication set to windows authentication — Msmit1993
– Msmit1993, Commented Mar 27, 2014 at 11:17

Amit Rai Sharma · Accepted Answer · 2014-03-27 11:27:34Z

3

Well I would create a Custom Authorization Attribute and implement HandleUnauthorizedRequest method to solve this problem.

public class CustomAutorizeAttribute : AuthorizeAttribute
{
   protected override bool AuthorizeCore(HttpContextBase httpContext)
   {
      // do authorization logic
      // ...


      return (/* isAuthorized */);
   }


   protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
   {
      UrlHelper urlHelper = new UrlHelper(filterContext.RequestContext);


      filterContext.Result = new RedirectResult(urlHelper.Action("Index", "Error"));
   }
}

For more information read How to: Create a Custom Authorization Attribute

answered Mar 27, 2014 at 11:27

Amit Rai Sharma

4,2351 gold badge30 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Shahzad Ilyas Over a year ago

this is the correct way of authorization as you wanted to tell the user that you don't have the permission.

Subhash Rao · Accepted Answer · 2014-03-27 11:21:58Z

1

use

 [Authorize(Roles = GROUP)]
  [HandleError(ExceptionType = typeof(UnauthorizedAccessException), View = "ApplicationError")]
    public void Auth()
    {
        /* if user is in the domain and signed in
         * and a member of the above group 
         * they will come here */

        username = User.Identity.Name;

        //Do somthing
    }

where you can sepcify view for unauthorized access user

answered Mar 27, 2014 at 11:21

Subhash Rao

3352 silver badges7 bronze badges

1 Comment

Msmit1993 Over a year ago

Thanks for the suggestion but it still prompts for username and password

Collectives™ on Stack Overflow

ASP.NET IIS user role authentication

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related