Question

So I set this above my Controller:
[Authorize(Roles=”Administrator”)]

The problem is whether they are not logged in, or don’t have the right role, it redirects them to the login page. Is there a way to have it handle authorization and authenticate differently?

Answer 1

I might not understand you clearly, but authentication and authorization are always coming together.. One says which mechanism use to authenticate user (forms, windows etc.), and second which roles or users are allowed to see the content…

As far as authentication method is set in your web config it is fixed, and only think you can use to protect your controller methods is to put those attributes.

Also if you want to use it diffrently, f.e. redirect to diffrent page you can use following code:

public class RedirectAuthorizeAttribute : AuthorizeAttribute
{
    public string RedirectUrl { get; set; }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        filterContext.Result = new RedirectResult(RedirectUrl);
    }
}

and then put it onto your controller method like that:

    [RedirectAuthorize(Roles = "MyRole", RedirectUrl = "SomeUrl")]
    public ActionResult SomeAction()
    {
       ...
    }