MVC4 Authorize Attribute overide; how to get passed in Roles?

Question

I'm trying to create my own [Authorize] Attribute so I can use my own authorize logic to have hierarchal roles.

If someone does [Authorize(Roles = "Admin")] on a controller or action How do I get the string "Admin" in my AuthorizeCore function?

I'm using this code:

public class Authorize : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        //authorize role logic
            if (true)
                return true;

        return false;
     }
    }

MVC4, .net 4.5, c#, VS 2012

score 9 · Accepted Answer · edited May 23 '17 at 10:30

9

It is quit a common thing that you have faced with.

This recommendation in post should work in MVC4 as it is working in MVC 3: - ASP.NET MVC - Alternative to Role Provider?

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        bool isAdmin;
        if(Roles.Contains("Admin"))
           isAdmin = true;

        return isAdmin ;
    }

edited May 23 '17 at 10:30

Community

1
1

answered Dec 13 '12 at 21:35

Yusubov

5,815
9
32
69

1

Thanks, I was under the impression that Roles was the roles of the currently logged in user, and did not think it would have what was passed in with `[Authorize("Admin")]` – Kyle Dec 13 '12 at 21:40
@user1308743, no problem, also voting the answers is good thing not to forget ;) – Yusubov Dec 13 '12 at 21:43
I was just waiting for the time limit to pass, to mark as answer and vote =) – Kyle Dec 13 '12 at 21:44
No problem, let me know if there are any issues. – Yusubov Dec 13 '12 at 21:45

score 1 · Answer 2 · answered Dec 13 '12 at 21:35

Roles is a public property. You should be able to do this:

public class Authorize : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {

        if(Roles.Contains("MyRole"))
           return true;

        return false;
    }
}

Or whatever it is that you need to do

score 0 · Answer 3 · answered Dec 13 '12 at 21:43

If you need to get the list of allowed roles, you can simply get the Roles property. It will list the string that was specified in the attribute decoration.

public class Authorize : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var allowedRoles = Roles;
    }
}

You can see this on the AuthorizeAttribute definition

MVC4 Authorize Attribute overide; how to get passed in Roles?

3 Answers3