Question

I can’t get SS authentication to work together with an Umbraco installation. Whenever I access a DTO or service with the Authenticate attribute, I get redirected to an umbraco login.
To reproduce:
I’ve created a new project, and installed Umbraco from Nuget (tried 4.7.1, 4.8.1 and 4.9.0 with same result), and SS from Nuget. I setup SS to run under the /api path in the web.config:

  <location path="api">
    <system.web>
      <httpHandlers>
        <add path="*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" />
      </httpHandlers>
    </system.web>
    <!-- Required for IIS 7.0 -->
    <system.webServer>
      <modules runAllManagedModulesForAllRequests="true" />
      <validation validateIntegratedModeConfiguration="false" />
      <handlers>
        <add path="*" name="ServiceStack.Factory" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" preCondition="integratedMode" resourceType="Unspecified" allowPathInfo="true" />
      </handlers>
    </system.webServer>
  </location>

and added /api to reserved paths to avoid Umbraco handling this:

<add key="umbracoReservedPaths" value="~/umbraco,~/install/,~/api" />

And in the AppHost.cs I’ve changed the EndpointHostConfig and enabled authentication:

   SetConfig(new EndpointHostConfig
   {
       DebugMode = true, //Show StackTraces when developing
       ServiceStackHandlerFactoryPath = "api"
   });

//Enable Authentication
ConfigureAuth(container);

And I’ve changed the connectionstring in ConfigureAuth to use the Umbraco database:

    var connectionString = ConfigurationManager.AppSettings["umbracoDbDSN"];

Finally I set the attribute on HelloWorldService:

[Authenticate]
public class HelloService : ServiceBase<Hello>
{
    protected override object Run(Hello request)
    {
        return new HelloResponse { Result = "Hello, " + request.Name };
    }
}

I then access the HelloWorldService through REST Uri:

http://localhost:56835/api/hello

and right away I’m redirected to:

http://localhost:56835/apilogin?redirect=http%3a%2f%2flocalhost%3a56835%2fapi%2fhello

and presented with the default Umbraco 404 page, which means that SS suddenly makes Umbraco handle the authentication. If I remove the Authenticate attribute, SS handles the request perfectly.

What am I missing?

Answer 1

It seems that FormsAuthentication is just plain annoying, and when it spots a 401 it changes that to 302 login.aspx.
My solution was use use the idea from this link: http://haacked.com/archive/2011/10/04/prevent-forms-authentication-login-page-redirect-when-you-donrsquot-want.aspx

In short it revert the 401->302 change from FormsAuthentication back to 401.
I changed it a bit in the detection code:

 if (response.StatusCode == 401 && request.RawUrl.ToLower().StartsWith("/api"))

and removed the Register and added it manually AFTER the FormsAuthentication module in web.config