Can someone help me to understand how it works in Asp.net? How can I check the roles of the users (not logged in) in the Razor View?
Let's say a situation like this:
In controller I get a list of all users:
var Users = await _context.ApplicationUser.ToListAsync()
return View(Users);
and in View:
#foreach ( var user in Users){
if (user.IsInRole("Admin")) <---- check here if the user is in role
{
do something
}
}
How can I check if a specific role is assigned to each user?
You need to inject usermanager in your constructor. Then do
await _userManager.IsInRoleAsync(user, role.Name);
I'm migrating a SaaS app from Classic ASP to .NET MVC5 and will use EF6 Database First. The login form for end users is customisable by each tenant (on their own subdomain but pointing to the same web application). We wish to use the existing database schema and the new authentication & authorization filters.
For example, a user on one tenant may login by entering their first name, surname and a code generated by our system. A user on another tenant may login by entering their email address and a password. Additionally, each tenant has a separate administrator login which uses a username and password. Another tenant may use LDAP authentication against a remote AD server.
Is there a definitive best practice way of doing custom authentication?
Almost every article appears to suggest different ways of accomplishing this: simply setting FormsAuthentication.SetAuthCookie, using a custom OWIN provider, override AuthorizeAttribute, etc.
In Classic ASP, we queried the database to find out the type of login for that tenant, displayed the appropriate fields on the login screen and then on post back, checked the fields match what's in the database and then set the session variables appropriately which were checked on each page request.
Thanks
I find that Identity framework is very flexible in terms of authentication options. Have a look on this bit of authentication code:
var identity = await this.CreateIdentityAsync(applicationUser, DefaultAuthenticationTypes.ApplicationCookie);
authenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
This is pretty standard run of the mill authentication part in Identity, you'll find this in every Identity sample on the web. If you look closely it is very flexible - all you need for authentication is ApplicationUser object that framework does not care how you get.
So in theory you can do things like this (pseudocode, I did not try to compile this):
// get user object from the database with whatever conditions you like
// this can be AuthCode which was pre-set on the user object in the db-table
// or some other property
var user = dbContext.Users.Where(u => u.Username == "BillyJoe" && u.Tenant == "ExpensiveClient" && u.AuthCode == "654")
// check user for null
// check if the password is correct - don't have to do that if you are doing
// super-custom auth.
var isCorrectPassword = await userManager.CheckPasswordAsync(user, "enteredPassword");
if (isCorrectPassword)
{
// password is correct, time to login
// this creates ClaimsIdentity object from the ApplicationUser object
var identity = await this.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
// now we can set claims on the identity. Claims are stored in cookie and available without
// querying database
identity.AddClaim(new Claim("MyApp:TenantName", "ExpensiveClient"));
identity.AddClaim(new Claim("MyApp:LoginType", "AuthCode"));
identity.AddClaim(new Claim("MyApp:CanViewProducts", "true"));
// this tells OWIN that it can set auth cookie when it is time to send
// a reply back to the client
authenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
}
Using this authentication, you have set a few claims on the user - they are stored in the cookie and available everywhere via ClaimsPrincipal.Current.Claims. Claims are essentially a collection of key-value pairs of strings and you can store there anything you like.
I usually access claims from the user via extension method:
public static String GetTenantName(this ClaimsPrincipal principal)
{
var tenantClaim = principal.Claims.FirstOrDefault(c => c.Type == "MyApp:TenantName");
if (tenantClaim != null)
{
return tenantClaim.Value;
}
throw new ApplicationException("Tenant name is not set. Can not proceed");
}
public static String CanViewProducts(this ClaimsPrincipal principal)
{
var productClaim = principal.Claims.FirstOrDefault(c => c.Type == "MyApp:CanViewProducts");
if (productClaim == null)
{
return false;
}
return productClaim.Value == "true";
}
So in your controller/view/business layer you can always call to ClaimsPrincipal.Current.GetTenantName() and in this case you'd get "ExpensiveClient" back.
Or if you need to check if a specific feature is enabled for the user, you do
if(ClaimsPrincipal.Current.CanViewProducts())
{
// display products
}
It is up to you how you store your user properties, but as long as you set them as claims on the cookie, they will be available.
Alternatively you can add claims into the database for every user:
await userManager.AddClaimAsync(user.Id, new Claim("MyApp:TenantName", "ExpensiveClient"));
And this will persist the claim into the database. And by default, Identity framework adds this claim to the user when they login without you needing to add it manually.
But beware, you can't set too many claims on a cookie. Cookies have 4K limit set by browsers. And the way Identity cookie encryption works it increases encoded text by about 1.1, so you can have roughly 3.6K of text representing claims. I've run into this issue here
Update
To control access to controllers via claims you can use the following filter on the controller:
public class ClaimsAuthorizeAttribute : AuthorizeAttribute
{
public string Name { get; private set; }
public ClaimsAuthorizeAttribute(string name)
{
Name = name;
}
public override void OnAuthorization(AuthorizationContext filterContext)
{
var user = HttpContext.Current.User as ClaimsPrincipal;
if (user.HasClaim(Name, Name))
{
base.OnAuthorization(filterContext);
}
else
{
filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary()
{
{"controller", "errors"},
{"action", "Unauthorised"}
});
}
}
}
and then use this attribute on controllers or separate actions like this:
[ClaimsAuthorize("Creating Something")]
public ActionResult CreateSomething()
{
return View();
}
User will require "Create Something" claim on them to access this action, otherwise they will be redirected to "Unauthenticated" page.
Recently I've played with claims authentication and made a prototype application similar to your requirement. Please have a look on the simple version: https://github.com/trailmax/ClaimsAuthorisation/tree/SimpleClaims where claims are stored individually for each user. Or there is more complex solution where claims belong to a role and when users login, role claims assigned to the user: https://github.com/trailmax/ClaimsAuthorisation/tree/master
There's two components you need. The authentication itself and the strategy each user gets for authentication.
The first is easy and is accomplished with these two lines...
var identity = await UserManager.CreateIdentityAsync(user,
DefaultAuthenticationTypes.ApplicationCookie);
AuthenticationManager.SignIn(new AuthenticationProperties()
{ IsPersistent = isPersistent }, identity);
When a user is Signed In, they get an identity which contains the user's claims on roles and who they are. These are given to the user as a cookie. After this point you just decorate controllers with [Authorize] to make sure only authenticated users can log in. Pretty standard here.
The only complicated part in the problem is the second part; The strategy for how each user gets authenticated set by the admin.
Some pseudocode for how this could work in actions is this...
// GET: /Account/Login
[AllowAnonymous]
public ActionResult Login(int tenantId)
{
var tenant = DB.GetTenant(tenantId);
return View(tenant);
}
In your view you would output the authentication strategy for the tenant. That may be email and password, a code and email, or whatever your requirements.
When the user enters their info and clicks to login, you then have to determine what strategy they were using, and check to see if their information matches.
//
// POST: /Account/Login
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model)
{
var tenant = DB.GetTenant(model.tenantId);
//If user info matches what is expected for the tenants strategy
if(AuthenticateUserInfo(tenant, model.UserInputs))
{
//Sign the user in
var identity = await UserManager.CreateIdentityAsync(user,
DefaultAuthenticationTypes.ApplicationCookie);
AuthenticationManager.SignIn(new AuthenticationProperties()
{ IsPersistent = isPersistent }, identity);
}
}
I did a lot of hand-waving in the second part because of the complicated nature of how dynamic it is. Overall you should use the same strategies you used in your legacy application to generate the right inputs and such. Nothing has changed there, only the way you sign in is going to be different.
Using Visual Studio 2013 Update 3 you can create a new Web Application that comes with MVC5, EF6 and Identity already installed. Here is how to select Identity when you create a new Application:
With MVC Template selected, click Change Authentication and the highlighted window will pop up. Individual User Accounts = Identity. Click ok and continue.
Having done that, you have created an application with Identity. You can now customize your login and registration as follows.
You want to look at your AccountController.cs in the Controllers folder. Here you will find the script for Registration and Login.
If you look at the
public async Task<ActionResult> Register(RegisterViewModel model)
function, you'll notice it contains:
IdentityResult result = await UserManager.CreateAsync(new ApplicationUser() { UserName = newUser.UserName }, newUser.Password);
This is where the user gets created. If you want to use Identity, you should save the users username and password. You can use an e-mail as the username if you want. etc.
After doing that, I add the user a specified role (I find the user and then add it to the role):
ApplicationUser userIDN = UserManager.FindByName(newUser.UserName);
result = await UserManager.AddToRoleAsync(userIDN.Id, "Admin");
In my scenario, I have created an additional extended table where I hold their address, phone number, etc. In that table, you can hold any additional login information. You can add these new entries before or after creating the users account in Identity. I would create the extended information and then create the Identity account just to be sure.
IMPORTANT: For any scenarios where a user is logging in with something that is not a username or e-mail address that isn't saved into via Identity, you will have to do a custom solution.
Example: User types in their first name, surname and the code. You could do two things: Save the first name and surname into the username field of identity and the code into the password and verify the login that way
OR
you would check your custom table for those properties and make sure they match, if and when they do you could call this little beauty:
await SignInAsync(new ApplicationUser() { UserName = model.UserName }, isPersistent: false);
Once you call that SignInAsync function, you can go ahead and direct them to your protected page.
NOTE: I'm creating the ApplicationUser on the function call but if you use it more than once it would be ideal for you to declare the ApplicationUser as follows:
ApplicationUser user = new ApplicationUser() { UserName = model.UserName };
NOTE #2: If you don't want to user Async methods, those functions all have non-async versions of them.
Note #3: At the very top of any page using UserManagement, it is being declared. Make sure if you are creating your own controller that wasn't generated by Visual Studio to use Identity, you include the UserManagement declaration script at the top inside of the class:
namespace NameOfProject.Controllers
{
[Authorize]
public class AccountController : Controller
{
public AccountController() : this(new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()))) { }
public AccountController(UserManager<ApplicationUser> userManager) { UserManager = userManager; }
public UserManager<ApplicationUser> UserManager { get; private set; }
Please let me know if you have any questions and I hope this helps.
I am currently working on an MVC 4 project and i need to give acces to the database to the mobile apllication so i choosed to implement my Web services in Web Api to get a Json resulat .
The problem is i have many code redundancy ! the same code is existent in MVC controller and in the Web Api controller .
For exemple the get procedure :
1- web api controller :
public User GetUser(int id)
{
User user = db.Users.Find(id);
if (user == null)
{
throw new HttpResponseException(Request.CreateResponse(HttpStatusCode.NotFound));
}
return user;
}
2-MVC controller
public ActionResult Details(int id = 0)
{
User user = db.Users.Find(id);
if (user == null)
{
return HttpNotFound();
}
return View(user);
}
one is returning the User entity in JSon and the other return a view !
So how can use one Controller in the other to get rid of redandency ?
Looking at this question from the point of view of separation of concerns, both of the controllers have a different function (supplying JSON and markup respectively), but both need to make use of a common service: namely, data persistence.
For that reason, as #paul suggested in the comments, the repository pattern offers a good design to solve this problem. In your example, you may not seem to gain much, but as soon as your data retrieval and persistence logic becomes more complex, the repository will enforce consistency, reduce redundancy, and support more sophisticated patterns such as dependency injection.
Here's a simple repository:
interface IRepository
{
User GetUser(int id);
}
public class MyRepository: IRepository
{
public User GetUser(int id)
{
return db.Users.Find(id);
}
}
Api controller
public User GetUser(int id)
{
var repo = new MyRepository();
User user = repo.GetUser(id);
if (user == null)
{
throw new HttpResponseException(Request.CreateResponse(HttpStatusCode.NotFound));
}
return user;
}
MVC controller:
public ActionResult Details(int id = 0)
{
var repo = new MyRepository();
User user = repo.GetUser(id);
if (user == null)
{
return HttpNotFound();
}
return View(user);
}
As paul said this is all about separation of concerns. Paul provided you an example with a "logical service layer" which is an independent class library in your solution that your other Web Applications or desktop applications etc. reference it. Another example may be a "physical service layer" which is another Web Api Project in your solution, that contains all the service methods of your application. From your MVC project whenever you want a call to have your users, you create a new WebClient to call your web api's GetUser end points.
You can just return JSON() from the MVC controller and avoid the usage of two frameworks. There is nothing wrong with that, and will keep your life simple.
public ActionResult GetUser(int id) // GetUser is the action name, or you can just use Index
{
User user = db.Users.Find(id);
if (user == null)
{
return HttpNotFound();
}
return Json(user);
}
I am having issues understanding what I need to do with this and how to get them to interact.
I have created an MVC 4 Internet Application. From what I understand, the login mechanism uses the SimpleMembershipProvider which is not compatible with the SQL based ASP.NET Membership provider.
I have an existing site that uses ASP.NET Membership and we are going to be leveraging this. I only need a login controller. The User name is being passed in by the original application that is calls my new application. This is all on an intranet, and we are creating a simple SSO model.
From what I can tell I will need to add in the "DefaultMembershipProvider" entry into the web.config and create a connection string to my membership DB. I have that much.
But I am unclear as to what the code will need to look like for the controller.
Here is the code that I currently have for the controller for the simple provider:
[HttpPost]
[AllowAnonymous]
public ActionResult LoginAuto(string userid)
{
LoginModel model = new LoginModel();
if (!string.IsNullOrEmpty(userid))
{
model.UserName = userid;
model.RememberMe = true;
model.Password = "Dude!!!!1";
if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, persistCookie: model.RememberMe))
{
return RedirectToAction("Index", "Home");
}
}
else
{
model.UserName = "";
}
// If we got this far, something failed, redisplay form
ModelState.AddModelError("", "The user name or password provided is incorrect.");
return View("Login", model);
}
Will I need to change this at all? Will the actual controller class be different from what comes with the template? I'm pretty new to the actual security thing and looking for some direction.
Thanks.
I'm using the membership provider asp.net mvc 4.
I'd like to get a list of users and their roles without Roles.GetRolesForUser() for each user.
In my application, the business requirements state that a user will only ever be assigned one role.
What I'm currently doing:
[GridAction]
public ActionResult _GetUsers()
{
var users = Membership.GetAllUsers().Cast<MembershipUser>().Select(n => new AdminAccountEditModel
{
Role = Roles.GetRolesForUser(n.UserName).FirstOrDefault(),
IsApproved = n.IsApproved,
Email = n.Email,
UserName = n.UserName
}).ToList();
return View(new GridModel(users));
}
Very inefficient. How do I fix this?
Thanks.
In the past I've cheated somewhat when using the standard membership provider and have written a lot of complex queries directly against the tables in sql. What you're looking for is a simple join.
I just ended up using EF and linq to get the result.
[GridAction]
public ActionResult _GetUsers()
{
var users = from user in xcsnEntities.Users
select new
{
Role = user.Roles.FirstOrDefault().RoleName,
IsApproved = user.Membership.IsApproved,
Email = user.Membership.Email,
UserName = user.UserName
};
return View(new GridModel(users));
}