how to implement this mvc filter attribute?

Question

I need to integrate a new Security API into several existing applications in my organization. Some applications use ASP.NET MVC and use the .NET AuthorizeAttribute class to decorate classes with security.

For example:

[Authorize(Roles="MY_CORP\Group1,MY_CORP\Group2")]
public class MyClass
{
    //
}

The code above is based on a Windows authentication configuration. I need to update this implementation to use the new Security API. The new Security API will retrieve a user like this:

var user = new SecurityApi().GetUser(userId);
var groups = user.Groups;

So ideally the updated decorator would look something like this, where GroupX and GroupY exist as user.Groups returned from the Security API:

[Authorize(Roles="GroupX, GroupY")]
public class MyClass
{
    //
}

Any idea how I would go about implementing this?

Have you checked this out? Not exactly what you want but I think it will get you there: stackoverflow.com/questions/41940905/… — JuanR
– JuanR, Commented May 25, 2018 at 19:39

ttugates · Accepted Answer · 2018-05-26 01:20:40Z

0

I use something along the lines of this:

public class RequireAuthAttribute : TypeFilterAttribute
{
    public RequireAuthAttribute(params Roles[] rolesRequirement) 
        : base(typeof(RequireAuthFilter))
    {
        Arguments = new object[] { rolesRequirement };
    }

    public enum Roles: ushort
    {
        CompanyOnly,
        AuthenticatedCustomer,
        AuthorizedCustomer,
        AuthorizedOwnerManager
    }
}

With:

public class RequireAuthFilter : IAsyncActionFilter
{
    private readonly Roles[] _rolesToAllow;

    public RequireAuthFilter(Roles[] rolesRequirement = default(Roles[]))
    {
        _rolesToAllow = rolesRequirement;
    }

    public async Task OnActionExecutionAsync(
    ActionExecutingContext context, 
    ActionExecutionDelegate next ) 
    {
        // Verify is Authenticated
        if (context.HttpContext.User.Identity.IsAuthenticated != true)
        {
            context.HttpContext.SetResponse(401, "User is not Authenticated");
            return;
        }

        var isCompanyAdmin = context.HttpContext.IsCompanyAdmin(); 
        // ^ HttpContext Extension method that looks at our JWT Token 
        // and determines if has required Cliams/Roles.

        if (isCompanyAdmin == true)
        {
            await next();
            return;
        } else {
            context.HttpContext.SetResponse(401, "Restricted to Company");
            return;
        }

        // Other custom logic for each role.
        // You will want to decide if comma represents AND or an OR 
        // when specifying roles.
    }
}

And use like this:

[RequireAuth(Roles.CompanyOnly, Roles.AuthorizedOwnerManager)]
public class MyClass
{
    //
}

edited May 26, 2018 at 1:20

answered May 26, 2018 at 1:15

ttugates

6,3624 gold badges48 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user9393635 Over a year ago

it looks like TypeFilterAttribute belongs to package Microsoft.AspNetCore.Mvc. I need to implement the solution in an app with a target framework of 4.5.2. Can the TypeFilterAttribute solution be used with a 4.5.2 solution? Or can you recommend an alternative approach for 4.5.2?

ttugates Over a year ago

It will be a couple hours before I am able to get you the code.. But its doable with googling.. I ported this solution over to .Net Core around 6 months ago. Will post solution this evening after work.

Collectives™ on Stack Overflow

how to implement this mvc filter attribute?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related