Authorization MVC3-ASP.NET

Question

I am using windows authentication in my application. I am using MVC3 –Asp.Net with Entity framework. I have a list of menu, which are buttons. I am displaying them using them using sitemap. I am able to hide or show those buttons using the roles available in the Active directory. I have two issues

1) If I log in as a basic user(Some of the buttons are not visible to me) , which is what I want but if I am typing a Controller/Action(this Page should be invisible to me) in browser it loads up.

Solution:

I am checking the User and its role as the first line in the Action, if I am authorised to see that, then I am displaying otherwise redirecting to the other page. It is taking time to authenticate a user from the Active Directory.

2) If I log in as a basic user and trying to see a Action been authorised for super user it still displays(when I manually type the Controller and Action Name)

Solution:

I am checking the User and its role as the first line in the Action, if I am authorised to see that, then I am displaying otherwise redirecting to the other page. It is taking time to authenticate a user from the Active Directory.

Clarifications:

I can use Authorize attribute with roles and I am thinking this is only for ASP.NET Membership, and Hence Does not seems to work as my roles are coming from the Active Directory in the System.

Question:

Could any one point me to solution, where Instead of checking the permissions on each view can I not do that in Global. asax file. If I can authenticate the user once when he logged in , I don’t need to authenticate him for other views.

Eranga · Accepted Answer · 2011-06-01 13:20:14Z

In both cases I would suggest you write custom RoleProvider Active Directory Role Provider. Then if you have setup your MembershipProvider and RoleProvider correctly the Authorize attribute should work.

To avoid retrieving Roles of the user on each request through RoleProvider you can cache the roles of that user in the session. You can do that in the custom RoleProvider or by using custom Authorize attribute.

I am not a big fan of Session, It makes thing so slow and Cannot predict the behaviou sometimes, Thank you for the answer.
you don't have to use the session variable. you need to cache the retrieved roles somewhere so that you don't have access it for each request of the user

Collectives™ on Stack Overflow

Authorization MVC3-ASP.NET

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related