Question

I have a couple of table on my database that specify witch users ( Depending on your AD Username) can actually use the current ASP.NET MVC 2 app I’m building.

My question is how ( or more likely where and where do I put it? On the master page?? ) do i write a method that gets the AD user out of the HTTP context and validates it against the database to see if you can actually use the app? If you can… the idea it’s to write a couple of keys in the Session object with the information I need ( Role, Full Name, etc ).

I’m quite confused regarding how I should accomplish this and if it’s actually the right way… Keep in mind that I have an admin section and non-admin section in my app.

Any thoughts?

Edit: Keep in mind that I do not care to authenticate the user through a form. All I want to check is if according to my database and your AD username you can use my app. If you can write to session in order to perish the information I need. Otherwise just throw an error page.

This is what I’ve implemented so far, is this the way to go?
What’s the second method for? ( I’m sorry I’m kind of new to c#) What I want to do it’s actually throw a view if yo’re not authorized…

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
  var isAuthorized = base.AuthorizeCore(httpContext);
  if (isAuthorized)
  {
    var canUse = this._userRepo.CanUserUseApp(httpContext.User.Identity.Name);
    if (!canUse)
    {
      isAuthorized = false;
    }
  }
  return isAuthorized;
} 

Answer 1

You could activate and use Windows (NTLM) authentication and then write a custom [Authorize] attribute where you could fetch the currently connected AD user and perform the additional check of whether he is authorized or not to use the application against your data store. Then you would decorate controllers/actions that require authorization with this custom attribute.

---

UPDATE:

Here’s an example of how such custom attribute might look like:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var isAuthorized = base.AuthorizeCore(httpContext);
        if (isAuthorized)
        {
            // The user is authorized so far => check his credentials against
            // the custom data store 
            return IsUserAllowedAccess(httpContext.User.Identity.Name);
        }
        return isAuthorized;
    }

    private bool IsUserAllowedAccess(string username)
    {
        throw new NotImplementedException();
    }
}

and then:

[MyAuthorize]
public class FooController: Controller
{
    public ActionResult Index()
    {
        ...
    }
}