I am trying to customize the authorize in mvc 3. In the home controller i am setting role to be...
Session["role"] = "Admin";
I am getting the error at
SiteRoles role = (SiteRoles)httpContext.Session["role"];
saying Specified cast is not valid.
I dont have a clue what is happening.
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
throw new ArgumentNullException("httpContext");
string[] users = Users.Split(',');
if (!httpContext.User.Identity.IsAuthenticated)
return false;
string role = (string)httpContext.Session["role"];
if (Roles != 0 && ((Roles & role) != role))
return false;
return true;
}
You are setting a string inside the session, so you should use a string when reading back:
string role = (string)httpContext.Session["role"];
Or if you wanted to set some custom type:
Session["role"] = SiteRoles.Admin;
and then you will be able to:
SiteRoles role = (SiteRoles)httpContext.Session["role"];
Related
i implemented custom media-type formatter with per request logic
public class JsonPermissionBasedFormatter : PartialJsonMediaTypeFormatter
{
public override MediaTypeFormatter GetPerRequestFormatterInstance(Type type, HttpRequestMessage request, MediaTypeHeaderValue mediaType)
{
User user = request.GetOwinContext()?.Request.Get<User>("AuthorizationFilter:CurrentUser");
var formatter = (PartialJsonMediaTypeFormatter)base.GetPerRequestFormatterInstance(type, request, mediaType);
formatter.SerializerSettings = SerializerSettings;
formatter.SerializerSettings.ContractResolver = new PermissionBasedContractResolver(user);
return formatter;
}
}
public class PermissionBasedContractResolver : DefaultContractResolver
{
private readonly User _user;
public PermissionBasedContractResolver(User user)
{
_user = user;
NamingStrategy = new CamelCaseNamingStrategy
{
ProcessDictionaryKeys = true,
OverrideSpecifiedNames = true
};
}
protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization)
{
if (member == null)
{
throw new ArgumentNullException(nameof(member));
}
JsonProperty property = base.CreateProperty(member, memberSerialization);
var propertyInfo = member as PropertyInfo;
if (propertyInfo != null)
{
if (!PermissionsHelper.IsPropertyVisibleForUser(propertyInfo, _user))
{
property.ShouldSerialize = DoNotSerialize;
}
}
return property;
}
static bool DoNotSerialize(object o)
{
return false;
}
}
public static bool IsPropertyVisibleForUser(PropertyInfo info, User user)
{
if (info.GetCustomAttribute<IgnoreDataMemberAttribute>() != null)
return false;
if (user == null) return true;
var permissionForExportAttribute =
info.GetCustomAttribute<VisibleForAttribute>();
if (permissionForExportAttribute != null)
{
return
user.HasPermission(permissionForExportAttribute.Permission);
}
return true;
}
PermissionBasedContractResolver add custom logic for serialization which depend on user rights. For example user with admin rights receives additional properties in json, which ordinary user do not.
But if run requests in the following manner:
Parallel.For(1, 10000, _ =>
{
Get(ordinaryUser, isAdmin: false);
Get(adminUser, isAdmin: true);
});
occasionally got for ordinaryUser json properties availiable only for admins. i dont understand how it can happens.
Problem can be reproduce only under some load, if run requests manually via postman - all is ok. Can you tell what it can be or give advices how to investigate such problem.
I have two controllers, AdminController and AccountController with the following code
AccountController:
[HttpPost]
public ActionResult LogOn(LogOnViewModel model)
{
if (ModelState.IsValid)
{
_authenticationService.SetPrincipal(model.UserName);
var exists = _authenticationService.ValidateCredentials(userName, password);
FormsAuthentication.SetAuthCookie(model.UserName, false);
if(exists){
return RedirectToAction("Index", "Admin");
}
}
return RedirectToAction("LogOn");
}
AdminController:
[Authenticate]
public class AdminController : Controller
{
[HttpGet]
public ActionResult Index()
{
return View();
}
}
AuthenticateAttribute is inherited from AuthorizeAttribute and has the following code:
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
var authenticated = false;
if (HttpContext.Current.User != null && HttpContext.Current.User.Identity.IsAuthenticated)
{
//some actions
}
else
{
FormsAuthentication.SignOut();
FormsAuthentication.RedirectToLoginPage();
}
return authenticated;
}
_authenticationService is the instance of AuthenticationService class and SetPrincipal() method has the following code:
public void SetPrincipal(string userName)
{
var identity = new GenericIdentity(userName);
var principal = new GenericPrincipal(identity, null);
Thread.CurrentPrincipal = principal;
if (HttpContext.Current != null)
{
var ticket = new FormsAuthenticationTicket(1,
principal.Identity.Name,
DateTime.Now,
DateTime.Now.AddMinutes(30),
false,
String.Empty,
FormsAuthentication.FormsCookiePath);
string encryptedCookie = FormsAuthentication.Encrypt(ticket);
var authenticationCookie = HttpContext.Current.Response.Cookies[FormsAuthentication.FormsCookieName];
if (authenticationCookie != null)
{
authenticationCookie.Value = encryptedCookie;
authenticationCookie.Expires = DateTime.Now.AddMinutes(30);
}
HttpContext.Current.User = principal;
}
}
When I debug and watch AuthenticationService.SetPrincipal() HttpContext.Current.User.Identity.IsAuthenticated is true. But after redirect to Index action of AdminController in AuthenticateAttribute.AuthorizeAttribute() HttpContext.Current.User.Identity.IsAuthenticated is always false. As result I redirected to LogOn view again.
What am I doing wrong?
I don't see anywhere where you actually send the cookie back to the client. In order to be authenticated on each subsequent request, you have to send the encrypted cookie back to the client so that it can pass it back to your site.
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedCookie);
Response.Cookies.Add(cookie);
I see where you try and get the current authentication cookie here:
var authenticationCookie = HttpContext.Current.Response.Cookies[FormsAuthentication.FormsCookieName];
But again, this is a GET, not a SET (or sending the cookie back) function line. At this point in your authentication, if you set a debugger, authenticationCookie is always going to be NULL.
Also, I don't see where you validate the password in any of your actions or functions. Ensure you are not overlooking that step.
One more thought/question/issue with your code. You are setting a variable called userExists in your controller action, but the function you call is a void type, so...you don't need to set that variable, just call the function.
_authenticationService.SetPrincipal(model.UserName);
return RedirectToAction("Index", "Admin");
I've been learning how to implement CustomRoleProvider from a few tutorials and managed to implement 2 main methods as below
public override string[] GetRolesForUser(string userName)
{
string connectionString =
ConfigurationManager.ConnectionStrings["myDb"].ConnectionString;
DataContext context = new DataContext(connectionString);
Table<UserObj> usersTable = context.GetTable<UserObj>();
UserObj userObj = usersTable.SingleOrDefault(u => u.UserName == userName);
string roleId = userObj.UserRoleID;
if (roleId != null)
return roleId.Select(c => c.ToString()).ToArray();
else
return new string[] { };
}
public override bool IsUserInRole(string userName, string roleName)
{
string connectionString =
ConfigurationManager.ConnectionStrings["myDb"].ConnectionString;
DataContext context = new DataContext(connectionString);
Table<UserObj> usersTable = context.GetTable<UserObj>();
UserObj userObj = usersTable.SingleOrDefault(u => u.UserName == userName);
if (userObj != null)
{
string roleId = userObj.UserRoleID;
if (roleId.Equals(roleName))
return true;
}
return false;
}
Then I added [Authorize(Roles = "admin")] on the index method of a controller which I want only admin to get access. When I tried to access the page, it seems to perform a restriction ok, for example, if I entered url:
http://localhost:60353/module
..it redirected me to
http://localhost:60353/Account/LogOn?ReturnUrl=%2fmodule
However, the role didn't seem to be checked.
What have I done wrong here?
I also face same problem but i am able to call CustomProvider Method:
IsUserInRoles()
explicitly,but it does seem to be correct because the accessibility is not changed....it always redirect to login screen only.......
I am creating my own custom authorize attribute, overriding the AuthorizeCore method and wanted to know if it is possible to access the Roles which have been passed into the authorize attribute tag.
So for instance if I have this:
[CustomAuthorize(Roles = "Administrator, Sales, Entry")]
Is it possible to access these from inside here:
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
}
I could then split the string and create an array.
You can this this.Roles which is a string that you need to split.
The source code is freely available.
The default AuthorizeCore implementation:
protected virtual bool AuthorizeCore(HttpContextBase httpContext) {
if (httpContext == null) {
throw new ArgumentNullException("httpContext");
}
IPrincipal user = httpContext.User;
if (!user.Identity.IsAuthenticated) {
return false;
}
if (_usersSplit.Length > 0 && !_usersSplit.Contains(user.Identity.Name, StringComparer.OrdinalIgnoreCase)) {
return false;
}
if (_rolesSplit.Length > 0 && !_rolesSplit.Any(user.IsInRole)) {
return false;
}
return true;
}
And they have an internal split function which looks like this:
internal static string[] SplitString(string original) {
if (String.IsNullOrEmpty(original)) {
return new string[0];
}
var split = from piece in original.Split(',')
let trimmed = piece.Trim()
where !String.IsNullOrEmpty(trimmed)
select trimmed;
return split.ToArray();
}
I am developing an asp.net mvc 3.0 application which has a simple authentication process. User fills a form which is sent to server by ajax call and gets response, but the problem here is that using the following method :
FormsAuthentication.SetAuthCookie(person.LoginName,false);
is not enough to fill 'HttpContext.Current.User' and it needs the below method to be run :
FormsAuthentication.RedirectFromLoginPage("...");
Problem here is that as i mentioned, the loggin form uses an ajax form, and get responses with json, so redirecting is not possible.
How could I fill 'HttpContext.Current.User' ?
Thanks.
Update :
Here is register method :
[HttpPost]
public ActionResult Register(Person person)
{
var q = da.Persons.Where(x => x.LoginName == person.LoginName.ToLower()).FirstOrDefault();
if (q != null)
{
ModelState.AddModelError("", "Username is repettive, try other one");
return Json(new object[] { false, this.RenderPartialViewToString("RegisterControl", person) });
}
else
{
if (person.LoginName.ToLower() == "admin")
{
person.IsAdmin = true;
person.IsActive = true;
}
da.Persons.Add(person);
da.SaveChanges();
FormsAuthentication.SetAuthCookie(person.LoginName,false);
return Json(new object[] { true, "You have registered successfully!" });
}
}
FormsAuthentication doesn't support immediate setting of user's identity, but you should be able to fake it by something like this:
HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(
new System.Security.Principal.GenericIdentity(person.LoginName),
new string[] { /* fill roles if any */ } );
Here is the version I ended up using, which is based on the answer by #AdamTuliper-MSFT. It is only meant to be used right after logging in, but before redirect, to allow other code to access HttpContext.User.
Don't do anything if already authenticated
Doesn't modify the cookie, since this should only be used for the lifetime of this request
Shorten some things, and a little safer with userdata (should never be null, but...)
Call this after you call SetAuthCookie(), like below:
// in login function
FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
AuthenticateThisRequest();
private void AuthenticateThisRequest()
{
//NOTE: if the user is already logged in (e.g. under a different user account)
// then this will NOT reset the identity information. Be aware of this if
// you allow already-logged in users to "re-login" as different accounts
// without first logging out.
if (HttpContext.User.Identity.IsAuthenticated) return;
var name = FormsAuthentication.FormsCookieName;
var cookie = Response.Cookies[name];
if (cookie != null)
{
var ticket = FormsAuthentication.Decrypt(cookie.Value);
if (ticket != null && !ticket.Expired)
{
string[] roles = (ticket.UserData as string ?? "").Split(',');
HttpContext.User = new GenericPrincipal(new FormsIdentity(ticket), roles);
}
}
}
Edit: Remove call to Request.Cookies, as #AdamTuplier-MSFT mentioned.
You need to manually set it. Rather than reinventing the wheel, note the section here on updating the current principal for the request - thats your option here.
How to set Request.IsAuthenticated to true when not using FormsAuthentication.RedirectFromLoginPage?
public void RenewCurrentUser()
{
System.Web.HttpCookie authCookie =
System.Web.HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
if (authCookie != null)
{
FormsAuthenticationTicket authTicket = null;
authTicket = FormsAuthentication.Decrypt(authCookie.Value);
if (authTicket != null && !authTicket.Expired)
{
FormsAuthenticationTicket newAuthTicket = authTicket;
if (FormsAuthentication.SlidingExpiration)
{
newAuthTicket = FormsAuthentication.RenewTicketIfOld(authTicket);
}
string userData = newAuthTicket.UserData;
string[] roles = userData.Split(',');
System.Web.HttpContext.Current.User =
new System.Security.Principal.GenericPrincipal(new FormsIdentity(newAuthTicket), roles);
}
}
}