2

I am using servicestack. I want to authenticate users differently based on the route in the API. For example: If the user is accessing a company route: /api/company (POST) (update to company data) I want to use the master keys stored in super admin account (for example). But if the user is accessing some trivial data say employee departments, then the authentication of that employee, Route: /api/employees/74274762764/departments (GET)

So how do I do this if I am using Credentials Authentication (inheriting and implementing).

Do I detect the paths and write logic? That will be very brittle. Theoretically I want to specify attribute on services and provide the authentication needed. So something like:

[CorporateAuthentication] or [UserAuthentication] so the authentication logic can figure out where to validate the user.

Please help.

Thanks

Amit

Amit Jindal
  • 63
  • 1
  • 6

1 Answers1

1

Normally when you have resources with different levels of accessibility, you don't actually want to Authenticate differently, instead you want the resources protected by varying roles or permissions that are attached on Authenticated users.

There's an example of how to use ServiceStack's Authentication and authorization wiki page:

[Authenticate]
//All HTTP (GET, POST...) methods need "CanAccess"
[RequiredRole("Admin")]
[RequiredPermission("CanAccess")]
[RequiredPermission(ApplyTo.Put | ApplyTo.Post, "CanAdd")]
[RequiredPermission(ApplyTo.Delete, "AdminRights", "CanDelete")]
public class Secured
{
    public bool Test { get; set; }
}

This earlier StackOverflow Answer goes into detail of how Roles and Permissions work in ServiceStack.

Community
  • 1
  • 1
mythz
  • 141,670
  • 29
  • 246
  • 390
  • I know this already. The scenario I am describing is for a condition where we have normal user authentication for most functions but for resetting user password or for certain special things we need a different password. – Amit Jindal Nov 03 '12 at 18:29
  • Can't you just supply an additional Password/ApiKey/Guid in the services that need it? – mythz Nov 03 '12 at 18:33
  • Well, right now it is coming to TryAuthenticate as username and password. What I am doing is if it fails user authentication, I check for master authentication. I would rather not do it. – Amit Jindal Nov 03 '12 at 19:40