o_19mgorv9t13a3ko71fev19l81mqa.pdf

Figure 18-2. Re-prompting for credentials for a local request by the custom authorization filter
Using the Built-in Authorization Filter
Although I used the AuthorizeAttribute class as the base for the custom filter, it has its own implementation of the
AuthorizeCore method which is useful for performing general purpose authorization tasks. When using the
AuthorizeAttribute directly, I can specify an authorization policy using two public properties of this class, as shown
in Table 18-3.
Table 18-3. AuthorizeAttribute Properties
Name Type Description
Users
Roles
string A comma-separated list of usernames that are allowed to access the action method.
string A comma-separated list of role names. To access the action method, users must be in at least one of these roles.
Listing 18-12 shows how I can use the built-in filter to protect an action method with one of these properties.
Listing 18-12. Using the Built-in Authorization Filter
using System.Web.Mvc;
using Filters.Infrastructure;
namespace Filters.Controllers {
public class HomeController : Controller {
}
}
[Authorize(Users = "admin")]
public string Index() {
return "This is the Index action on the Home controller";
}
I have specified that the admin user is authorized to invoke the Index action method, but there is an implicit condition as
well: the request is authenticated. If I do not specify any users or roles, then any authenticated user can use the action method.
For most applications, the authorization policy that AuthorizeAttribute provides is sufficient. If you want to
implement something special, you can derive from this class as just I did earlier in the chapter or supplement your configuration
with authentication filters, which I describe the next section.
468