User1094269964 posted
HI Friends,
Need help on the below scenario for Custom AuthorizeAttribute implementation.
When the user login using Authentication/Login(FormCollection form) users roles will be fetched from database. See my code below but its not working
Lets say User1 logins to the application and we fetches his UserId,UserName and his roles.
Lets say his roles are "Admin,Developer,Tester" then he is allowed to call all the Action methods of AdminController,DeveloperController and TestController
But in case User1 has "Admin" role alone then he is allowed to call all the Action method of AdminController Only.
But in case User1 has "Developer" role alone then he is allowed to call all the Action method of DeveloperController Only.
How to do the above. Please help.
Below is my code and it is not working as per the above
namespace Sample.Controllers
{
public class AuthenticationController : Controller
{
[HttpGet]
public ActionResult Login()
{
return View();
}
[HttpPost]
public void Login(FormCollection form)
{
UserSession userSession = UserSession.LoadUserSession(System.Web.HttpContext.Current.Session);
userSession.UserID = form["UserId"].ToUpper();
string url = "~/Authentication/NotAuthorized";
try
{
userSession.ValidateUser();
if(userSession.HasUserAuthenticated)
{
UserSession.SaveUserSession(System.Web.HttpContext.Current.Session, userSession);
url = "~/Home/Index";
}
}
catch(Exception ex)
{
throw ex;
}
this.Response.Redirect(url, false);
}
[HttpGet]
public ActionResult NotAuthorized()
{
return View();
}
}
public class AdminController :Controller
{
[HttpGet]
[CustomAuthorize(Roles.ADMIN)]
public ActionResult Index()
{
return View();
}
[HttpPost]
[CustomAuthorize(Roles.ADMIN)]
public ActionResult Index(FormCollection collection)
{
return View();
}
}
public class DeveloperController :Controller
{
[HttpGet]
[CustomAuthorize(Roles.ADMIN,Roles.DEVELOPER)]
public ActionResult Index()
{
return View();
}
[HttpPost]
[CustomAuthorize(Roles.ADMIN, Roles.DEVELOPER)]
public ActionResult Index(FormCollection collection)
{
return View();
}
}
public class TesterController :Controller
{
[HttpGet]
[CustomAuthorize(Roles.ADMIN, Roles.TESTER)]
public ActionResult Index()
{
return View();
}
[HttpPost]
[CustomAuthorize(Roles.ADMIN, Roles.TESTER)]
public ActionResult Index(FormCollection collection)
{
return View();
}
}
}
public class CustomAuthorize : AuthorizeAttribute
{
public readonly string[] AllowedRoles;
UserSession loggedInUser = null;
public CustomAuthorize(params string[] roles)
{
this.AllowedRoles = roles;
}
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
loggedInUser = UserSession.LoadUserSession(System.Web.HttpContext.Current.Session);
bool authorize = false;
if(loggedInUser.HasUserAuthenticated)
{
if(this.AllowedRoles.Count() > 0)
{
foreach (string role in this.AllowedRoles)
{
if (loggedInUser.UserRoles.Contains(role))
{
authorize = true;
}
}
}
authorize = true;
}
return authorize;
}
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
if(loggedInUser.HasUserAuthenticated)
{
filterContext.Result = new RedirectResult("/Authentication/NotAuthorized");
}
else
{
filterContext.Result = new HttpUnauthorizedResult();
}
}
}
public class UserSession
{
public string UserID { get; set; }
public string UserName { get; set; }
public List<string> UserRoles { get; set; }
public UserSession()
{
this.UserRoles = new List<string>();
}
public bool HasUserAuthenticated { get; set; }
public void ValidateUser()
{
OracleParameter[] param = null;
param = new OracleParameter[] { new OracleParameter("UserId", this.UserID) };
OracleDataReader reader = DBHelper.ExecuteReader("select UserID,UserName,UserRoles from UserTable where UserId=:UserId", param);
while (reader.Read())
{
this.UserID = reader.GetString(0);
this.UserName = reader.GetString(1);
string roles = reader.GetString(2); //here we will get command separated string
foreach (string role in roles.Split(','))
{
this.UserRoles.Add(role);
}
}
}
public static UserSession LoadUserSession(HttpSessionState state)
{
if (state["_userSession"] == null)
{
return new UserSession();
}
return state["_userSession"] as UserSession;
}
public static void SaveUserSession(HttpSessionState state, UserSession session)
{
state["_userSession"] = state;
}
}
public class DBHelper
{
public static OracleDataReader ExecuteReader(string query, OracleParameter[] param)
{
OracleConnection connection = new OracleConnection("somestring");
try
{
connection.Open();
OracleCommand cmd = new OracleCommand(query, connection);
foreach (var item in param)
{
cmd.Parameters.Add(item);
}
return cmd.ExecuteReader();
}
catch
{
return null;
}
}
}
public class SampleConstants
{
}
public static class Roles
{
public const string ADMIN = "Admin";
public const string DEVELOPER = "Developer";
public const string TESTER = "Tester";
}
