ASP.net MVC - Authorize with Windows Authentication/Role Provider

Question

I am using Windows Authentication in my MVC application with the WindowsTokenRoleProvider. I created a controller action that looks like:

[Authorize(Roles=@"Fake\Role")]
public ActionResult Admin()
{
    return View();
}

When I try and hit this page I see a blank page. Is there a way for me to display a custom view that says "You are not authorized to view this page" isntead of just showing a blank page. If I was using forms authentication then it would redirect me to the login page, but that doesn't really make sense for Windows Authentication since you never really log in specifically.

possible duplicate of Redirecting unauthorized controller in ASP.NET MVC — dlev
– dlev, Commented Sep 1, 2011 at 16:42
@dlev I'm not sure if this is actually a duplicate. That question while not specifically mentioning Forms Auth seems to be entirely focused on forms auth. This is about windows auth. — Chris Marisic
– Chris Marisic, Commented Sep 1, 2011 at 16:44
@Chris The answer to the linked question talks about setting a different Result in a custom AuthorizationFilter, which is a good way to go about this. — dlev
– dlev, Commented Sep 1, 2011 at 16:46

Chris Marisic · Accepted Answer · 2011-09-01 16:42:45Z

1

You most likely are not getting a blank page (I'm not absolutely certain). You are most likely getting a http response that has no content, but has a 403 not authorized status code.

Assuming this is accurate, all you need to do is setup in ASP.NET custom errors (and IIS custom errors) is a redirect rule for 403 codes to the appropriate page.

answered Sep 1, 2011 at 16:42

Chris Marisic

33.2k30 gold badges169 silver badges265 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Dismissile Over a year ago

Ah you're probably right. It appears as a blank page in IE :)

Dismissile Over a year ago

I added a customerrors section with both 403 and 404 error codes. If i type an invalid address then it will redirect me to my 404 page, but when I try and view the page I'm not authorized to see, I still see a blank page. I can't use fiddler because I don't have admin priveleges to install on my machine. How can I tell if it's really a 403?

Chris Marisic Over a year ago

Firebug in Firefox, or the developer tools in IE9 and Chrome should also let you see the response code. If none of those work, you should be able to use curl to directly call the url. Also did you set both the IIS custom errors AND asp.net custom errors?

Chris Marisic Over a year ago

And ouch for not being a local admin on your machine as a developer. That's a requirement for my employment, any company that refuses to give me a proper working environment which includes local admin, VS2010, resharper, and a high powered machine I will refuse to work for.

Dismissile Over a year ago

I just got the machine and it's an error...it will be corrected :)

|

Collectives™ on Stack Overflow

ASP.net MVC - Authorize with Windows Authentication/Role Provider

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related