Turn off Authentication in MVC using web.config

Question

I have an MVC site, secured using [Authorize] attributes, but have an issue on a production website that uses Single Sign On accross a couple or sites on different servers. I want to rule Authentication out as the cause; is there a way to temporarily turn off the Authentication through web.config so that all or some Controller Actions that have the Authorize Attribute can be accessed without logging in?

EDIT:

I have tried adding the following to web.config:

<authentication mode="None" />

But this causes all actions decorated with Authorize Attribute to render blank pages. Actions without Authorize continue to work though

I love it. I just searched for: asp.net authentication none blank page, and found this question. My problem was that I had authorization set to none but accidentally had leftover Authorize statements in one of my controllers. Your question was my answer. Thanks! — TTT
– TTT, Commented Apr 10, 2013 at 23:59

Erik Philips · Accepted Answer · 2013-12-17 10:55:01Z

9

is there a way to temporarily turn off the Authentication through web.config so that all or some Controller Actions that have the Authorize Attribute can be accessed without logging in?

No, this is not possible with the default framework. I'm pretty sure the AuthorizeAttribute in MVC source code will attempt to check and see if the user is logged in. Without an authenticated user, access would be denied.

edited Dec 17, 2013 at 10:55

answered Mar 26, 2012 at 21:51

Erik Philips

54.9k11 gold badges133 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Luke · Accepted Answer · 2014-11-20 10:00:33Z

9

Use [AllowAnonymous] to allow specific actions in a controller be used by unauthorized users.

answered Nov 20, 2014 at 10:00

Luke

1311 silver badge7 bronze badges

Comments

Cyrus · Accepted Answer · 2015-02-11 22:16:44Z

1

In your Web.config comment out the child:

<authentication mode="Windows" />
<authorization>
  <!--<deny users="?" />-->
</authorization>

answered Feb 11, 2015 at 22:16

Cyrus

991 silver badge2 bronze badges

Comments

Michael Freeman · Accepted Answer · 2015-11-01 12:53:40Z

0

You can allow all users access to the system by adding the following in the web.config. When the controller checks the authorization the user will be verified since you are letting all users with any windows authentication access the system.

<authentication mode="Windows" />
    <authorization>
      <allow users="*"/>
  <!--<deny users="?" />-->
    </authorization>

answered Nov 1, 2015 at 12:53

Michael Freeman

111 bronze badge

Collectives™ on Stack Overflow

Turn off Authentication in MVC using web.config

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related