ASP.Net MVC Custom Authorization for Web API

Question

I have a complex application with lots of Web Api Calls which need permission checks that are within the database. An example simple api call I might have is:

[HttpGet]
    public IEnumerable<StudentContact> GetStudentContacts(int id)
    {
        return db.StudentContacts.AsNoTracking().Where(n => n.StudentId == id && n.Current_Record == true).OrderBy(n => n.RankOrder);
    }

And to do a permissions check I have to do the following:

int staffID = (User as CustomPrincipal).UserId;
int siteId = Functions.GetSiteIdFromCookie();
if (Functions.UserHasAccess(staffID, AccessLevels.access_StudentDetailsUpdate,siteId) == true) return true;
else return false;

What I would like to achieve is to create a custom authorization annotation so that I can have:

[HttpGet]
[PermissionAuth(AccessLevels.access_StudentDetailsUpdate,AccessLevels.access_StudentDetailsReadOnly)]
public IEnumerable......

And I may need to have an option of and/or i.e. both are true or one is true. Can anyone help?

No is it easy to setup a custom filter? Will it deny access to the function? — user1166905
– user1166905, Commented Jan 8, 2015 at 12:20

Rajdeep Dosanjh · Accepted Answer · 2015-01-08 14:33:20Z

1

This is possible by extending the AuthorizeAttribute and overriding the IsAuthorized method. Something like the following is what you need.

public class PermissionAuthAttribute : AuthorizeAttribute
{
    private readonly List<string> _accessLevels;


    public PermissionAuth(params string[] accessLevels)
    {
         _accessLevels = accessLevels.ToList();
    }

    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        if (!base.IsAuthorized(actionContext))
        {
            return false;
        }
        int staffID = (User as CustomPrincipal).UserId;
        int siteId = Functions.GetSiteIdFromCookie();
        if (Functions.UserHasAccess(staffID, AccessLevels.access_StudentDetailsUpdate,siteId) == true) { 
            return true;
        }
        else {
            return false
        };
    }
}

Then above your method use [PermissionAuth(/*permissions here*/)]

edited Jan 8, 2015 at 14:33

answered Jan 8, 2015 at 12:32

Rajdeep Dosanjh

1,1971 gold badge9 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

user1166905 Over a year ago

I'll have a crack at this. What do you suggest I do in the case of an OR? i.e. as long as one of two permissions were set.

Rajdeep Dosanjh Over a year ago

essentially you just have to adust the logic if the IsAuthorized method returns true they are allowed in

user1166905 Over a year ago

In the code above how do I get the permissions entered in the annotation into the IsAuthorized method?

Rajdeep Dosanjh Over a year ago

They will be in the _accessLevels variables

user1166905 Over a year ago

VStudio doesn't like the _accessLevels = feature line here as it does not exist in the context

|

Collectives™ on Stack Overflow

ASP.Net MVC Custom Authorization for Web API

1 Answer 1

6 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Related