c# - Claims authorization using Thinktecture.IdentityModel -

as explained on leastprivilege, there 2 ways setup claims authorization checks using thinktecture.identitymodel. 1 setup filter. other add attributes actions want check.

i'm using attributes option. however, i'd override behavior of sending unauthorized (but authenticated) requests login page.

instead i'd present 401 error (or unauthorized page). far, have following class override handleunauthorizedrequest , throw 401 error (if authenticated). however, way i've figured out how wire in adding class filter. doing though, skips using attribute decorations , sends action/resource through checkacess method, useless us.

    public class customclaimsauthorizeattribute : thinktecture.identitymodel.authorization.mvc.claimsauthorizeattribute {     public customclaimsauthorizeattribute()     {     }      public customclaimsauthorizeattribute(string action, params string[] resources)         : base(action, resources)     {     }       protected override void handleunauthorizedrequest(authorizationcontext filtercontext)     {         if (filtercontext.httpcontext.user.identity.isauthenticated)             throw new unauthorizedaccessexception("insufficent permissions.");          base.handleunauthorizedrequest(filtercontext);     } } 

for whoever may interested. realized (ridiculously) simple using own class name attribute.

customclaimsauthorizeattribute("myparameter") public actionresult index() {   ... } 

additionally, found following in web.config file, throwing unauthorizedaccessexception won't present specified 401 error page user. instead receive general error page.

<customerrors mode="on" defaultredirect="errorpage.aspx">    <error statuscode="401" redirect="errornoaccess.aspx" /> </customerrors> 

this exception produces:

"asp.net not authorized access requested resource. consider granting access rights resource asp.net request identity. asp.net has base process identity (typically {machine}\aspnet on iis 5 or network service on iis 6 , iis 7, , configured application pool identity on iis 7.5) used if application not impersonating. if application impersonating via , identity anonymous user (typically iusr_machinename) or authenticated request user."

i instead decided throw 403 (forbidden) error. override ended looking this:

protected override void handleunauthorizedrequest(authorizationcontext filtercontext) {      if (filtercontext.httpcontext.user.identity.isauthenticated)         throw new httpexception((int)httpstatuscode.forbidden, "unauthorized access");      base.handleunauthorizedrequest(filtercontext); } 

and web.config error pages specified as:

<customerrors mode="on" defaultredirect="errorpage.aspx">   <error statuscode="403" redirect="errornoaccess.aspx" />   <error statuscode="404" redirect="errornotfound.aspx" />   <error statuscode="500" redirect="errorpage.aspx" /> </customerrors> 

i can log in user insufficient privileges , presented errornoaccess.aspx page instead of being thrown login page (which turned loop if had 'remember me' checked).

i truely don't understand ms thinking throwing user login page because of validly authenticated, unauthorized request. there's no feedback user why thrown login page , nothing hint user try different credentials (which highly unlikely have different credentials).