Custom Authentication Module inside MVC3 web app

Question

Context:

We have an internal Asp.Net web application which is configured to use windows authentication. As part of this authentication aspect, we have an HttpModule that essentially grabs the HttpContext.Current.Identity.Name and returns a UserInfo object which get dropped into the HttpContext.Items collection.

In migrating this over MVC3, I have a base controller and OnActionExecuting, I am unable to see this UserInfo item in the collection at all. Any insight would be great. Here's my setup:

BaseController:

protected override void OnActionExecuting(ActionExecutingContext ctx)
        {
            if (ctx.HttpContext.Items["UserInfo"] != null)
            {
                UserInfo currentUser = (UserInfo)ctx.HttpContext.Items["UserInfo"];
                dynamic viewBag = ctx.Controller.ViewBag;
                viewBag.CurrentUser = currentUser;
            }
            else
            {
                // Unauthorized do something
            }            

            base.OnActionExecuting(ctx);
        }

web.config:

<system.web>
    <httpModules>
      <add type="WFS.SIG.Client.Security.Authentication.WindowsAuthentication, WFS.SIG.Client.Security" name="AuthenticationModule"/>
    </httpModules>
</system.web>....

<system.webServer>
    <validation validateIntegratedModeConfiguration="false"/>
    <modules runAllManagedModulesForAllRequests="true">
      <add name="AuthenticationModule" type="WFS.SIG.Client.Security.Authentication.WindowsAuthentication, WFS.SIG.Client.Security" />
    </modules>
</system.webServer>

Take a look at http://stackoverflow.com/questions/1134442/httpcontext-items-with-asp-net-mvc — Gats, Apr 30 '12 at 20:42
It turns out that the issue was in the HTTP Module. It was serving requests only for .aspx, .svc and .ascx files. For MVC the requestor is the controller and it was not serving. Now the UserInfo item in the collection is coming through. — VajNyiaj, May 01 '12 at 16:09

slfan · Answer 1 · 2012-05-01T06:14:18.853

0

I think your code should look like this:

protected override void OnActionExecuting(ActionExecutingContext ctx) 
{ 
    if (ctx.HttpContext.Items["UserInfo"] != null) 
    { 
        UserInfo currentUser = (UserInfo)ctx.HttpContext.Items["UserInfo"]; 
        ViewBag.CurrentUser = currentUser; 
    } 
    else 
    { 
        // Unauthorized do something 
    }             
    base.OnActionExecuting(ctx); 
}

The access to HttpContext should work like this. But you can access the ViewBag directly.

Can you check whether your authenticaton module is really called and does store an object in the HttpContext? Can you set a breakpoint?

edited May 01 '12 at 06:14

answered Apr 30 '12 at 20:49

slfan

8,950
115
65
78

There's no exception being thrown. The issue is that the "If" condition is never met so the viewbag property never gets set. It seems to be like the HttpModule never gets initialize. – VajNyiaj May 01 '12 at 05:48
That's true. Try to set a breakpoint in your HttpModule code. What type of IIS you use? If IIS 7.x, is it in integrated mode? – slfan May 01 '12 at 06:15

Custom Authentication Module inside MVC3 web app

1 Answers1