ASP.NET MVC attribute

[McDonald, Jeffrey (Jeff)]

On 11/18/11 11:43 AM, "VanFosson, Timothy L" <timothy-vanfosson at uiowa.edu>
wrote:

> I'm about to implement a Shibboleth-protected site that uses ASP.NET MVC.
> I realize that I can use the existing ISAPI filter to protect various
> components of the site, but I'd like to still with the MVC  convention-
> based approach and use an AuthorizeAttribute (or a derived class based on
> that) that does the same work as the ISAPI filter,
> http://msdn.microsoft.com/en-
> us/library/system.web.mvc.authorizeattribute.aspx
> <http://msdn.microsoft.com/en-
> us/library/system.web.mvc.authorizeattribute.aspx> .

> Does anyone know of such an attribute? If not, are there any resources you
> can point me to (other than the source, which I have) that will help me
> understand the workflow of the filter so I can implement it as an
> attribute-based filter on my methods?  I'd happily contribute any work
> that I do back to the community or participate with others who might be
> working on this.

The simplest solution to configure the Shibboleth SP to not require a session, and then create a custom IAuthorizationFilter.  That way you can easily handle authz based on attributes asserted by the ISAPI module.

Something like:
[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited=true, AllowMultiple=true)]
public class RequireAttributeValueAttribute : FilterAttribute, IAuthorizationFilter
{
  public RequireAttributeValueAttribute(string name, string value)
  {
    AttributeName = name;
    RequiredValue = value;
  }

  public string AttributeName { get; set; }  
  public string RequiredValue { get; set; }

  public void OnAuthorization(AuthorizationContext filterContext)
  {
    //Check if user has Shibboleth session, if not redirect to Shibboleth login handler (usually /Shibboleth.sso/Login)
    //Check if logged in user has matching attribute, if not,
    filterContext.Result = new HttpUnauthorizedResult();
  }
}

Then use it like:
[RequireAttributeValue("affiliation", "student at osu.edu")]
Public ActionResult Foo()
{
}

-- Jeff