Authorize Attribute MVC 3 & Web.Config AppSettings Value

Question

Does anyone know if there is a way of using a value in Web.Config AppSettings section on an Authorize attribute for a controller in MVC3?

I am currently using something like this in web.config:

<add key="AdminRole" value="Admins"/>

, and then I tried pulling the into class and using the value on the Authorize attribute but .NET complains about the values not being constants, etc.

I just want to be able to use a value set in web.config to filter Authorization so that different deployments can use variations of role names based on their system configurations.

Any help would be appreciated, Thanks!

ScottE · Accepted Answer · 2014-07-22 16:47:00Z

Here's a working example:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
public class AuthorizeByConfig : AuthorizeAttribute
{

    /// <summary>
    /// Web.config appSetting key to get comma-delimited roles from
    /// </summary>
    public string RolesAppSettingKey { get; set; }

    /// <summary>
    /// Web.config appSetting key to get comma-delimited users from
    /// </summary>
    public string UsersAppSettingKey { get; set; }


    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {

        if (!String.IsNullOrEmpty(RolesAppSettingKey))
        {
            string roles = ConfigurationManager.AppSettings[RolesAppSettingKey];
            if (!String.IsNullOrEmpty(roles))
            {
                this.Roles = roles;
            }                
        }

        if (!String.IsNullOrEmpty(UsersAppSettingKey))
        {
            string users = ConfigurationManager.AppSettings[UsersAppSettingKey];
            if (!String.IsNullOrEmpty(users))
            {
                this.Users = users;
            }                
        }

        return base.AuthorizeCore(httpContext);
    }


}

And decorate your controller class or method like so:

[AuthorizeByConfig(RolesAppSettingKey = "Authorize.Roles", UsersAppSettingKey = "Authorize.Users")]

Where Authorize.Roles and Authorize.Users are web.config appSettings.

marcind · Accepted Answer · 2011-09-22 15:55:39Z

5

You would have to write your own AuthorizationAttribute class which at runtime reads the value from web.config. In .NET it is not possible to declare an attribute using runtime-dependent values.

answered Sep 22, 2011 at 15:55

marcind

53.3k13 gold badges129 silver badges112 bronze badges

3 Comments

M4V3R1CK Over a year ago

This seems like overkill. You think I would be better off creating an installation requirement that creates the specific role names I use in MVC?

nathan gonzalez Over a year ago

@M4V3R1CK, custom authorization attributes are not heavy. check out msdn.microsoft.com/en-us/library/ee707357(v=vs.91).aspx

M4V3R1CK Over a year ago

Has anybody come across occurrences where MVC does not recognize roles from Windows? I thought that roles translated to groups in Windows, but for some reason when I add a user to a group, check in MVC (using windows authentication) if that user.IsInRole("GroupJustAddedTo") always returns false. I have no idea why....Working in Server 2003 R2 with Windows Authentication enabled around the board. Confused :~( ???

Collectives™ on Stack Overflow

Authorize Attribute MVC 3 & Web.Config AppSettings Value

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related