WebApi Custom Authorize Attribute not working

Question

I need to protect my web api with one or more specific users from the active directory, in the web.config I have the following code:

<configSections> 
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />

    <section name="users" type="System.Configuration.NameValueFileSectionHandler,System, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />

  </configSections> 
  <users> 
    <add key="user" value="domain\loginname" /> 
  </users> 
  <system.web> 
    <authentication mode="Windows" /> 
    <compilation debug="true" targetFramework="4.5" /> 
    <httpRuntime targetFramework="4.5" /> 
  </system.web>

Then I have a custom authorize attribute which reads the user from the web.config section shown above.

public class MyAuthorizeAttribute : AuthorizeAttribute
    {

        public MyAuthorizeAttribute(params string[] userKeys)
        {
            List<string> users = new List<string>(userKeys.Length); 
            var allUsers = (NameValueCollection)ConfigurationManager.GetSection("users");
            foreach (var userKey in userKeys)
            {
                users.Add(allUsers[userKey]);
            }

            this.Users = string.Join(",", users);
        }

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            bool isAuthorized = base.AuthorizeCore(httpContext);
            bool isRequestHeaderOk = false;
            return isAuthorized && isRequestHeaderOk;
        }
    }

The problem is that the Authorize Core is never hit in the debugger, the JSON in the browser is always shown even if I put a hardcoded false , the breakpoint is never hit there.

Then I decorate my controllers with the custom authorize attribute

[MyAuthorize("user")]
        [ResponseType(typeof(tblCargo))]
        public IHttpActionResult GettblCargosByActivo()
        {
            var query = from c in db.tblCargos
                        orderby c.strCargo
                        select c;

            //var result = Newtonsoft.Json.JsonConvert.SerializeObject(query);
            //return result;

            return Ok(query);
        }

And in IIS, the only enabled method is Windows Authentication

when I browse to the site from another computer, then I get the authentication window, but the authoze method shown above is never hit.

THis is a nice post that lead me to the right direction (I believe) Custom Authorization in Asp.net WebApi - what a mess?

Answer 1

In my case, while refactoring, my controller class was no longer extending ApiController. This was necessary for my filter to fire.

Answer 2

1. You should use AuthorizeAttribute in System.Web.Http instead of System.Web.Mvc
2. Implement IsAuthorized instead.

---

protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        bool isAuthorized = base.IsAuthorized(actionContext);
        bool isRequestHeaderOk = false;
        return isAuthorized && isRequestHeaderOk;
    }