Question

I’ve got an MVC 2 application which won’t be doing its own authentication, but will retrieve a user ID from the HTTP request header, since users must pass through a gateway before reaching the application.

Once in the app, we need to match up the user ID to information in a “users” table, which contains some security details the application makes use of.

I’m familiar with setting up custom membership and roles providers in ASP.NET, but this feels so different, since the user never should see a login page once past the gateway application.

Questions:

1. How do I persist the user ID, if at all? It starts out in the request header, but do I have to put it in a cookie? How about SessionState?
2. Where/when do I get this information? The master page shows the user’s name, so it should be available everywhere.

I’d like to still use the [Authorize(Roles="...")] tag in my controller if possible.

Answer 1

We have a very similar setup where I work. As @Mystere Man mentioned, there are risks with this setup, but if the whole infrastructure is setup and running correctly, we have found it to be a secure setup (we do care about security). One thing to ensure, is that the SiteMinder agent is running on the IIS node you’re trying to secure, as it will validate an encrypted SMSESSION key also passed in the headers, which will make the requests secure (it would be extremely difficult to spoof the value of the SMSESSION header).

We are using ASP.NET MVC3, which has global action filters, which is what we’re using. But with MVC2, you could create a normal, controller level action filter that could be applied to a base controller class so that all of your controllers/actions will be secured.

We have created a custom configuration section that allows us to turn this security filter on and off via web.config. If it’s turned off, our configuration section has properties that will allow you to “impersonate” a given user with given roles for testing and debugging purposes. This configuration section also allows us to store the values of the header keys we’re looking for in config as well, in case the vendor ever changes the header key names on us.

public class SiteMinderConfiguration : ConfigurationSection
{
    [ConfigurationProperty("enabled", IsRequired = true)]
    public bool Enabled
    {
        get { return (bool)this["enabled"]; }
        set { this["enabled"] = value; }
    }

    [ConfigurationProperty("redirectTo", IsRequired = true)]
    public RedirectToElement RedirectTo
    {
        get { return (RedirectToElement)this["redirectTo"]; }
        set { this["redirectTo"] = value; }
    }

    [ConfigurationProperty("sessionCookieName", IsRequired = true)]
    public SiteMinderSessionCookieNameElement SessionCookieName
    {
        get { return (SiteMinderSessionCookieNameElement)this["sessionCookieName"]; }
        set { this["sessionCookieName"] = value; }
    }

    [ConfigurationProperty("userKey", IsRequired = true)]
    public UserKeyElement UserKey
    {
        get { return (UserKeyElement)this["userKey"]; }
        set { this["userKey"] = value; }
    }

    [ConfigurationProperty("rolesKey", IsRequired = true)]
    public RolesKeyElement RolesKey
    {
        get { return (RolesKeyElement)this["rolesKey"]; }
        set { this["rolesKey"] = value; }
    }

    [ConfigurationProperty("firstNameKey", IsRequired = true)]
    public FirstNameKeyElement FirstNameKey
    {
        get { return (FirstNameKeyElement)this["firstNameKey"]; }
        set { this["firstNameKey"] = value; }
    }

    [ConfigurationProperty("lastNameKey", IsRequired = true)]
    public LastNameKeyElement LastNameKey
    {
        get { return (LastNameKeyElement)this["lastNameKey"]; }
        set { this["lastNameKey"] = value; }
    }

    [ConfigurationProperty("impersonate", IsRequired = false)]
    public ImpersonateElement Impersonate
    {
        get { return (ImpersonateElement)this["impersonate"]; }
        set { this["impersonate"] = value; }
    }
}

public class SiteMinderSessionCookieNameElement : ConfigurationElement
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class RedirectToElement : ConfigurationElement
{
    [ConfigurationProperty("loginUrl", IsRequired = false)]
    public string LoginUrl
    {
        get { return (string)this["loginUrl"]; }
        set { this["loginUrl"] = value; }
    }
}

public class UserKeyElement : ConfigurationElement
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class RolesKeyElement : ConfigurationElement
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class FirstNameKeyElement : ConfigurationElement
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class LastNameKeyElement : ConfigurationElement
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class ImpersonateElement : ConfigurationElement
{
    [ConfigurationProperty("username", IsRequired = false)]
    public UsernameElement Username
    {
        get { return (UsernameElement)this["username"]; }
        set { this["username"] = value; }
    }

    [ConfigurationProperty("roles", IsRequired = false)]
    public RolesElement Roles
    {
        get { return (RolesElement)this["roles"]; }
        set { this["roles"] = value; }
    }
}

public class UsernameElement : ConfigurationElement 
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

public class RolesElement : ConfigurationElement 
{
    [ConfigurationProperty("value", IsRequired = true)]
    public string Value
    {
        get { return (string)this["value"]; }
        set { this["value"] = value; }
    }
}

So our web.config looks something like this

<configuration>
  <configSections>
    <section name="siteMinderSecurity" type="MyApp.Web.Security.SiteMinderConfiguration, MyApp.Web" />
    ...
  </configSections>
  ...
  <siteMinderSecurity enabled="false">
    <redirectTo loginUrl="https://example.com/login/?ReturnURL={0}"/>
    <sessionCookieName value="SMSESSION"/>
    <userKey value="SM_USER"/>
    <rolesKey value="SN-AD-GROUPS"/>
    <firstNameKey value="SN-AD-FIRST-NAME"/>
    <lastNameKey value="SN-AD-LAST-NAME"/>
    <impersonate>
      <username value="ImpersonateMe" />
      <roles value="Role1, Role2, Role3" />
    </impersonate>
  </siteMinderSecurity>
  ...
</configuration>

We have a custom SiteMinderIdentity…

public class SiteMinderIdentity : GenericIdentity, IIdentity
{
    public SiteMinderIdentity(string name, string type) : base(name, type) { }
    public IList<string> Roles { get; set; }
}

And a custom SiteMinderPrincipal…

public class SiteMinderPrincipal : GenericPrincipal, IPrincipal
{
    public SiteMinderPrincipal(IIdentity identity) : base(identity, null) { }
    public SiteMinderPrincipal(IIdentity identity, string[] roles) : base(identity, roles) { }
}

And we populate HttpContext.Current.User and Thread.CurrentPrincipal with an instance of SiteMinderPrincipal that we build up based on information that we pull from the request headers in our action filter…

public class SiteMinderSecurity : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        base.OnActionExecuting(filterContext);

        var request = filterContext.HttpContext.Request;
        var response = filterContext.HttpContext.Response;

        if (MyApp.SiteMinderConfig.Enabled)
        {
            string[] userRoles = null; // default to null
            userRoles = Array.ConvertAll(request.Headers[MyApp.SiteMinderConfig.RolesKey.Value].Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries), r => r.Trim());

            var identity = new SiteMinderIdentity(request.Headers[MyApp.SiteMinderConfig.UserKey.Value];, "SiteMinder");
            if (userRoles != null)
                identity.Roles = userRoles.ToList();
            var principal = new SiteMinderPrincipal(identity, userRoles);

            HttpContext.Current.User = principal;
            Thread.CurrentPrincipal = principal;
        }
        else
        {
            var roles = Array.ConvertAll(MyApp.SiteMinderConfig.Impersonate.Roles.Value.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries), r => r.Trim());
            var identity = new SiteMinderIdentity(MyApp.SiteMinderConfig.Impersonate.Username.Value, "SiteMinder") { Roles = roles.ToList() };
            var principal = new SiteMinderPrincipal(identity, roles);

            HttpContext.Current.User = principal;
            Thread.CurrentPrincipal = principal;
        }
    }
}

MyApp is a static class that gets initialized at application startup that caches the configuration information so we’re not reading it from web.config on every request…

public static class MyApp
{
    private static bool _isInitialized;
    private static object _lock;

    static MyApp()
    {
        _lock = new object();
    }

    private static void Initialize()
    {
        if (!_isInitialized)
        {
            lock (_lock)
            {
                if (!_isInitialized)
                {
                    // Initialize application version number
                    _version = FileVersionInfo.GetVersionInfo(Assembly.GetExecutingAssembly().Location).FileVersion;
                    _siteMinderConfig = (SiteMinderConfiguration)ConfigurationManager.GetSection("siteMinderSecurity");

                    _isInitialized = true;
                }
            }
        }
    }

    private static string _version;
    public static string Version
    {
        get
        {
            Initialize();
            return _version;
        }
    }

    private static SiteMinderConfiguration _siteMinderConfig;
    public static SiteMinderConfiguration SiteMinderConfig
    {
        get
        {
            Initialize();
            return _siteMinderConfig;
        }
    }
}

From what I gather of your situation, you have information in a database that you’ll need to lookup based on the information in the headers to get everything you need, so this won’t be exactly what you need, but it seems like it should at least get you started.

Hope this helps.