In ASP.NET MVC2 how do I configure a site such that by default no authentication is required, but on one particular controller I do want Windows Authentication.
Edit: I don't think this is possible based on my testing.
Add a comment
|
2 Answers
[Authorize]
public class MyController : Controller
{
public ActionResult Index()
{
return View();
}
}
will require authorization for all actions on MyController, but anything that doesn't have the [Authorize] attribute should then be publically accessible.
You'll also need to set the Windows authentication in web.config.
<authentication mode="Windows"/>
Edit
The only time it should be necessary to create a separate application is if you need to use both Windows and forms authentication within the same site - for instance, if you needed forms authentication for users to hit, say, a discussion forum, but windows authentication for an admin area. Since the authentication method is set at the application level and can't be overridden, in this case the parts of the app that require windows authentication would have to be split into a separate web app and virtual directory in IIS.
8 Comments
Josh Rickard
I actually tried that but when I change my web.config to use Windows authentication it prompts me to log in on all requests (even those without [Authorize]). Is there any way to scope the authentication to a particular route or something?
3Dave
You can't do it by route... hmmm. There's a deny=... attribute in web config that's probably necessary. let me look.
Eric King
Can't you put the [Authorize] attribute on the Action (instead of the controller)? Or is that MVC3 only?
3Dave
You can put it on either the controller or the action, but the question was about securing the entire controller. You can also put it on a base controller class, and anything that inherits from that class will require authorization.
3Dave
@CaffeineFueled did you go through the steps in the link I posted? It seems to be working for me here.
|
I do not think this is possible since you need to set windows auth at the site level in IIS. You will need two separate web apps for this functionality.
