o_19mgorv9t13a3ko71fev19l81mqa.pdf

}
}
public void
OnAuthenticationChallenge(AuthenticationChallengeContext context) {
if (context.Result == null || context.Result is
HttpUnauthorizedResult) {
context.Result = new RedirectToRouteResult(new
RouteValueDictionary {
{"controller", "GoogleAccount"},
{"action", "Login"},
{"returnUrl", context.HttpContext.Request.RawUrl}
});
}
}
}
}
My implementation of the OnAuthentication method checks to see if the request has been authenticated using a
username that ends with @google.com. If the request is not authenticated or the request is authenticated using a different
kind of credential, then I set the Result property of the AuthenticationContext object to a new
HttpUnauthorizedResult.
The HttpUnauthorizedResult is set as the Result value for the
AuthenticationChallengeContext object that is passed to the OnAuthenticationChallenge
method and you can see that I have updated this method to challenge the user when this happens, coordinating the actions of the
two methods in the filter. The next step is to apply the filter to the controller, which you can see in Listing 18-17.
Listing 18-17. Applying the Authentication Filter in the HomeController.cs File
using System.Web.Mvc;
using Filters.Infrastructure;
namespace Filters.Controllers {
public class HomeController : Controller {
[Authorize(Users = "admin")]
public string Index() {
return "This is the Index action on the Home controller";
}
}
}
[GoogleAuth]
public string List() {
return "This is the List action on the Home controller";
}
I have defined a new action method called List, which I decorated with the GoogleAuth filter. The result is that access
to the Index method is secured through the built-in support for forms authentication but that access to the List action
method is secured through my custom fake Google authentication system.
You can see the effect by starting the application. By default the browser will target the Index action method, which will
trigger the standard authentication and require you to log in using one of the usernames that I defined in the Web.config file.
If you then request the /Home/List URL, then your existing credentials will be rejected and you will have to authenticate
using a Google username.
472