Question

Currently I use [Authorize(Roles = “…..”)] to secure my controller actions on my ASP.NET MVC 1 app, and this works fine. However, certain search views need to have buttons that route to these actions that need to be enabled/disabled based on the record selected on the search list, and also the security privs of the user logged in.

Therefore I think I need to have a class accessing a DB table which cross-references these target controller/actions with application roles to determine the state of these buttons. This will, obviously, make things messy as privs will need to be maintained in 2 places – in that class/DB table and also on the controller actions (plus, if I want to change the access to the action I will have to change the code and compile rather than just change a DB table entry).

Ideally I would like to extend the [Authorize] functionality so that instead of having to specify the roles in the [Authorize] code, it will query the security class based on the user, controller and action and that will then return a boolean allowing or denying access. Are there any good articles on this – I can’t imagine it’s an unusual thing to want to do, but I seem to be struggling to find anything on how to do it (could be Monday-morning brain). I’ve started some code doing this, looking at article http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/ , and it seems to be starting off ok but I can’t find the “correct” way to get the calling controller and action values from the httpContext – I could possibly fudge a bit of code to extract them from the request url, but that doesn’t seem right to me and I’d rather do it properly.

Cheers

MH

Answer 1

I found this on another forum and so will post it here in case anyone finds it useful. Note that how you do this changes depending on whether you are using MVC 1 or 2

the class you create needs to implement

public void OnAuthorization(AuthorizationContext filterContext)

and then you can use

string controllerName = filterContext.RouteData.Values["controller"].ToString();

and the same, substituting “action” for “controller” (make sure you check for nulls in these values first). In MVC 2 this can be changed to filterContext.ActionDescriptor.ActionName and .ActionDescriptor.ControllerDescriptor.ControllerName and you won’t have to check for nulls