How to display custom error if authorization fails in ASP.NET MVC

Question

Trying to figure out how to avoid requesting username and password when a controller action is called that has an Authorize header and simply redirect to a View.

In my web.config I have

<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" cacheRolesInCookie="false">
  <providers>
    <clear />
    <add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
  </providers>
</roleManager>
<authentication mode="Windows" />
<authorization>
  <deny users="?" />
</authorization>

Then, in my controller, I am prefixing an action as follows

    [Authorize(Roles = "DOMAIN\\Group")]
    public ActionResult Index()
    {
        ...controller action code here
    }

If I set it to a DOMAIN\Group that I belong to, then the application works just as expected. If I change it to a bogus group for testing, I am presented with a username and password dialog. Obviously, authentication will never happen. If I click cancel in the dialog, I get redirected to the 401 error page.

What I would LIKE to do is, since by definition in the web.config file only windows users can connect, if that windows user is not in the chosen group, simply redirect to a particular View rather than prompting for a username and password.

Win · Accepted Answer · 2016-09-30 17:50:48Z

9

You can create a custom attribute and override HandleUnauthorizedRequest. Then you redirect to a custom page, if authorization fails,

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            base.HandleUnauthorizedRequest(filterContext);
        }
        else
        {
            filterContext.Result = new RedirectToRouteResult(new
            RouteValueDictionary(new { controller = "Common", action = "AccessDenied" }));
        }
    }
}

[CustomAuthorize(Roles = "DOMAIN\\Group")]
public ActionResult Index()
{
   ...
}

answered Sep 30, 2016 at 17:50

Win

62.4k13 gold badges106 silver badges190 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Keith Clark Over a year ago

DOH !! Being fairly new to .net and c#, I forgot all about custom validation classes. Worked like a charm

atomaras Over a year ago

Authentication is different from Authorization

Collectives™ on Stack Overflow

How to display custom error if authorization fails in ASP.NET MVC

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related