3

I need to protect my web api with one or more specific users from the active directory, in the web.config I have the following code:

<configSections> 
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />

    <section name="users" type="System.Configuration.NameValueFileSectionHandler,System, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />

  </configSections> 
  <users> 
    <add key="user" value="domain\loginname" /> 
  </users> 
  <system.web> 
    <authentication mode="Windows" /> 
    <compilation debug="true" targetFramework="4.5" /> 
    <httpRuntime targetFramework="4.5" /> 
  </system.web>

Then I have a custom authorize attribute which reads the user from the web.config section shown above.

public class MyAuthorizeAttribute : AuthorizeAttribute
    {

        public MyAuthorizeAttribute(params string[] userKeys)
        {
            List<string> users = new List<string>(userKeys.Length); 
            var allUsers = (NameValueCollection)ConfigurationManager.GetSection("users");
            foreach (var userKey in userKeys)
            {
                users.Add(allUsers[userKey]);
            }

            this.Users = string.Join(",", users);
        }

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            bool isAuthorized = base.AuthorizeCore(httpContext);
            bool isRequestHeaderOk = false;
            return isAuthorized && isRequestHeaderOk;
        }
    }

The problem is that the Authorize Core is never hit in the debugger, the JSON in the browser is always shown even if I put a hardcoded false , the breakpoint is never hit there.

Then I decorate my controllers with the custom authorize attribute

[MyAuthorize("user")]
        [ResponseType(typeof(tblCargo))]
        public IHttpActionResult GettblCargosByActivo()
        {
            var query = from c in db.tblCargos
                        orderby c.strCargo
                        select c;

            //var result = Newtonsoft.Json.JsonConvert.SerializeObject(query);
            //return result;

            return Ok(query);
        }

And in IIS, the only enabled method is Windows Authentication

when I browse to the site from another computer, then I get the authentication window, but the authoze method shown above is never hit.

THis is a nice post that lead me to the right direction (I believe) Custom Authorization in Asp.net WebApi - what a mess?

2 Answers 2

9
  1. You should use AuthorizeAttribute in System.Web.Http instead of System.Web.Mvc
  2. Implement IsAuthorized instead.

protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        bool isAuthorized = base.IsAuthorized(actionContext);
        bool isRequestHeaderOk = false;
        return isAuthorized && isRequestHeaderOk;
    }
2
  • Thanks that helped and now the breakppoint is hit, however I have a question, bool isAuthorized = base.IsAuthorized(actionContext); is true only with the local administrator of the machine, even when I put another user on the web.config users section it returns false for him Feb 16, 2016 at 14:13
  • 1
    IsAuthorized is only true when the user has logged on to the system, it does not depend on the type of users. If you want more than simple IsAuthenticated or IsInRole checks, you can write your own authorization attribute and implement whatever logic you want
    – Phong Dao
    Feb 17, 2016 at 2:28
0

In my case, while refactoring, my controller class was no longer extending ApiController. This was necessary for my filter to fire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.