Custom Authorize filter not getting parameter passed in

Question

I am having trouble trying to use the standard Authorize attribute. It seems to be just ignored. My attempt to get around the problem was to write my own, which is being called but the parameters is not being passed.

The default constructor for BasicAuthorizeAttribute gets called but the one that takes the string parameter is never called. OnAuthorization is called too, but the Roles property is never set.

We are using Windows Authentication although the Authentication is set to None in the web.config. Changing this to Windows made no difference.

We are using MVC 5 and Castle Windsor, which I suspect is causing my problems.

On the controller as well as the action I have:

[BasicAuthorize(Roles = "Developer")]

The attribute filter

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class BasicAuthorizeAttribute : ActionFilterAttribute, IAuthorizationFilter
{
    public string Roles { get; set; }

    public BasicAuthorizeAttribute()
    {
    }

    public BasicAuthorizeAttribute(string roles)
    {
        Roles = roles;
    }

    public void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext)
    {
        if (!string.IsNullOrWhiteSpace(Roles))
        {
            // Check user roles here

            // User not in role
            filterContext.Result = new HttpUnauthorizedResult(); // mark unauthorized
        }
    }

    public void OnAuthenticationChallenge(AuthenticationChallengeContext filterContext)
    {
        var user = filterContext.HttpContext.User;
        if (user == null || !user.Identity.IsAuthenticated)
        {
            filterContext.Result = new HttpUnauthorizedResult();
        }
    }
}

The Castle Windsor is set up as follows.

...
Component.For<FilterAttribute>().ImplementedBy<BasicAuthorizeAttribute>().LifeStyle.PerWebRequest.Named(typeof(BasicAuthorizeAttribute).FullName)
...

In the web.config we have the following

...
<authentication mode="None" />
...
<modules>
        <remove name="FormsAuthenticationModule" />
</modules>
...

I spent over a day on this and Google is not my friend any more. Anyone with advice on how to resolve this? Or preferably use the default [Authorize(Roles = "...")] attribute?

EDIT

I found the culprit. The following lines was causing the problems.

var oldProvider = FilterProviders.Providers.Single(f => f is FilterAttributeFilterProvider);
FilterProviders.Providers.Remove(oldProvider);

Answer 1

I found the culprit. The following lines was causing the problems.

var oldProvider = FilterProviders.Providers.Single(f => f is FilterAttributeFilterProvider);
FilterProviders.Providers.Remove(oldProvider);

Answer 2

Since you are not providing any custom logic, you should just use the AuthorizeAttribute.

[Authorize(Roles = "Developer")]

The ideal way to use it is to register it as a global filter. Then you will have white list security (secure by default).

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());
        filters.Add(new AuthorizeAttribute());
    }
}

This means that all users must login in order to use any actions. And then on your controller, you can either override by user or role or by providing an AllowAnonymousAttribute.

public class HomeController : Controller
{
    // Everyone has access
    [AllowAnonymous]
    public ActionResult Index()
    {
        return View();
    }

    // Only logged in users have access
    public ActionResult About()
    {
        ViewBag.Message = "Your application description page.";

        return View();
    }

    // Only admins have access
    [Authorize(Roles = "Admin")]
    public ActionResult Contact()
    {
        ViewBag.Message = "Your contact page.";

        return View();
    }
}

Do note that AuthorizeAttribute requires some sort of authentication system in order to do anything. To get that working, the simplest solution is to select either the Windows or Web MVC template from Visual Studio. Note that the latest Visual Studio 2015 Community Edition is now free and contains many of the features that were missing from previous free editions.

As for DI, attributes are instantiated automatically by the .NET runtime so there is no way to inject them directly. You should not attempt to register the AuthorizeAttribute with the container because there would be no point.

See this answer if you need to customize the AuthorizeAttribute and thus need to actually make a DI-friendly authorization filter.