WebApi Custom System.Web.Http.AuthorizeAttribute does not recognize custom ClaimsPrincipal

Question

Here is a link to the source code that I will explain below.

http://www.filehosting.org/file/details/510152/CustomPrincipalSimpleSOFExample.zip

I have an issue where I am trying to set a (custom) ClaimsPrincipal. And then have access to it in a custom System.Web.Mvc.AuthorizeAttribute (mvc) and also a custom System.Web.Http.AuthorizeAttribute (webapi).

Things work fine and as expected in the custom System.Web.Mvc.AuthorizeAttribute. However, in the custom System.Web.Http.AuthorizeAttribute (webapi), when I search for a cookie I set earlier, the custom ClaimsPrincipal turns into a GenericPrincipal. (Or perhaps the custom ClaimsPrincipal never gets "set").

Here is the "trigger" code.

protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
{
    /* alternate the below value for invokeFormsAuthenticationTicketCode..  either true or false to see the issue */
    bool invokeFormsAuthenticationTicketCode = true;
          /* when "true", the MyCustomWebApiAuthorizeAttribute contains a GenericPrincipal IPrincipal, not a  MyCustomClaimsPrincipal*/



    if (invokeFormsAuthenticationTicketCode)
    {

        HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];

        if (authCookie != null)
        {
            /* we found the cookie set in the HomeController-Index (which simulates a user-successful login */
            FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);

            Employee empFromCookie = JsonConvert.DeserializeObject(authTicket.UserData);
            if (null == empFromCookie)
            {
                throw new ArgumentNullException("Employee did not serialize from Cookie correctly.");
            }

            ////////IIdentity iid = new GenericIdentity("I_Started_In_Application_PostAuthenticateRequest.GenericIdentity");

            /* so we know the simulation of the user-login "passed" because the cookie exists..lets set the MyCustomClaimsPrincipal */
            MyCustomClaimsIdentity iid = new MyCustomClaimsIdentity(new GenericIdentity("I_Started_In_Application_PostAuthenticateRequest.MyCustomClaimsIdentity.invokeFormsAuthenticationTicketCode = true"));
            MyCustomClaimsPrincipal princ = new MyCustomClaimsPrincipal(iid);

            Thread.CurrentPrincipal = princ;
            HttpContext.Current.User = princ;

        }
        /* so I realize that here...on the first pass through of this code.... the "Thread.CurrentPrincipal" and "HttpContext.Current.User" are not being set */
    }
    else
    {
        MyCustomClaimsIdentity iid = new MyCustomClaimsIdentity(new GenericIdentity("I_Started_In_Application_PostAuthenticateRequest.MyCustomClaimsIdentity.invokeFormsAuthenticationTicketCode = false"));
        MyCustomClaimsPrincipal princ = new MyCustomClaimsPrincipal(iid);

        Thread.CurrentPrincipal = princ;
        HttpContext.Current.User = princ;
    }
}

Here is the custom Mvc AuthorizeAttribute

   public class MyCustomMvcAuthorizeAttribute : AuthorizeAttribute
    {
        public MyCustomMvcAuthorizeAttribute()
        { }

        public override void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext)
        {
            IPrincipal x = HttpContext.Current.User;
            IPrincipal z = ClaimsPrincipal.Current;
            if (x.GetType() != typeof(MyCustomClaimsPrincipal))
            {
                throw new ArgumentOutOfRangeException("IPrincipal was not of type MyCustomClaimsPrincipal as expected");
                /* whether or not 'invokeFormsAuthenticationTicketCode = true or = false', this is always a MyCustomClaimsPrincipal */
            }
        }

        protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
        {
            IPrincipal x = HttpContext.Current.User;
            IPrincipal z = ClaimsPrincipal.Current;
            if (x.GetType() != typeof(MyCustomClaimsPrincipal))
            {
                throw new ArgumentOutOfRangeException("IPrincipal was not of type MyCustomClaimsPrincipal as expected");
                /* whether or not 'invokeFormsAuthenticationTicketCode = true or = false', this is always a MyCustomClaimsPrincipal */
            }
            return true;
        }
    }

Here is the custom webApi custom AuthorizeAttribute

 public class MyCustomWebApiAuthorizeAttribute : AuthorizeAttribute
    {
        public MyCustomWebApiAuthorizeAttribute()
        { }

        public override void OnAuthorization(HttpActionContext actionContext)
        {
            bool issueWasHit = false;
            IPrincipal x = HttpContext.Current.User;
            IPrincipal z = ClaimsPrincipal.Current;
            if(x.GetType() != typeof(MyCustomClaimsPrincipal))
            {
                //throw new ArgumentOutOfRangeException("IPrincipal was not of type MyCustomClaimsPrincipal as expected");
                string thisIsTheIssue = "This is the issue.  When 'invokeFormsAuthenticationTicketCode = true', this is a GenericPrincipal, not a MyCustomClaimsPrincipal";
                issueWasHit = true;
            }

            base.OnAuthorization(actionContext);

        }

        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            bool issueWasHit = false;

            IPrincipal x = HttpContext.Current.User;
            IPrincipal z = ClaimsPrincipal.Current;

            if (x.GetType() != typeof(MyCustomClaimsPrincipal))
            {
                //throw new ArgumentOutOfRangeException("IPrincipal was not of type MyCustomClaimsPrincipal as expected");
                string thisIsTheIssue = "This is the issue.  When 'invokeFormsAuthenticationTicketCode = true', this is a GenericPrincipal, not a MyCustomClaimsPrincipal";
                issueWasHit = true;
            }

            return true;
        }
    }

Here are my custom IIdentity (ClaimsIdentity) and IPrincipal (ClaimsPrincipal)

public class MyCustomClaimsIdentity : ClaimsIdentity
{
    public MyCustomClaimsIdentity(IIdentity identity)
        : base(identity)
    { }
}

public class MyCustomClaimsPrincipal : ClaimsPrincipal
{
    public MyCustomClaimsPrincipal(IIdentity iid)
        : base(iid)
    { }
}

So I started with a new MVC4 project. Which gives you a HomeController (mvc) and a ValuesController (webapi apicontroller).

Here is the altered code for those out of the box classes. HomeController.MyHomeControllerAlternateActionResult gets the custom attribute. and the "Index" simulates a user-login by setting a cookie that the global.asxa.cs (Application_PostAuthenticateRequest method) will pick up on later.

   public class HomeController : Controller
    {

        public ActionResult Index()
        {

            /* the below is simulating a user-login... the main-thing is that it is setting a "FormsAuthentication.FormsCookieName" cookie */

            Employee e = new Employee();
            e.SSN = "999-99-9999";

            string serializedUser = JsonConvert.SerializeObject(e,
                Formatting.None,
                new JsonSerializerSettings()
                {
                    ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore
                });

            /* so the point here is to just throw something in the "FormsAuthentication.FormsCookieName" cookie */
            FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                     1,
                     e.SSN,
                     DateTime.Now,
                     DateTime.Now.AddMinutes(15),
                     false,
                     serializedUser);

            string encTicket = FormsAuthentication.Encrypt(authTicket);
            HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
            Response.Cookies.Add(faCookie);

            /* cookie is in place, now redirect */

            return RedirectToAction("MyHomeControllerAlternateActionResult");
        }

        [MyCustomMvcAuthorizeAttribute]
        public ActionResult MyHomeControllerAlternateActionResult()
        {
            IEnumerable modelViaWay1 = null;
            ////////IEnumerable modelViaWay2 = null;
            ////////IEnumerable modelViaWay3 = null;
            string json = string.Empty;

            using (var client = new HttpClient())
            {
                string valuesControllerUrl = Url.RouteUrl(
                    "DefaultApi",
                    new { httproute = "", controller = "Values" }, /* ValuesController */
                    Request.Url.Scheme
                );

                modelViaWay1 = client
                            .GetAsync(valuesControllerUrl)
                            .Result
                            .Content.ReadAsAsync>().Result;

                ////////HttpResponseMessage response = client.GetAsync(valuesControllerUrl).Result;
                ////////json = response.Content.ReadAsStringAsync().Result;

                ////////modelViaWay2 = JsonConvert.DeserializeObject>(json);
                ////////modelViaWay3 = response.Content.ReadAsAsync>().Result;

            }

            return View(); /* this will throw a "The view 'MyHomeControllerAlternateActionResult' or its master was not found or no view engine supports the searched locations" error, but that's not the point of this demo. */
        }
    }

And the values controller, which simply adds the (webapi) custom authorizeattribute

 [MyCustomWebApiAuthorizeAttribute]
    public class ValuesController : ApiController
    {
        // GET api/values
        public IEnumerable Get()
        {

            var x = HttpContext.Current.User;
            var z = ClaimsPrincipal.Current;

            return new string[] { "value1", "value2" };
        }

        // GET api/values/5
        public string Get(int id)
        {
            return "value";
        }

        // POST api/values
        public void Post([FromBody]string value)
        {
        }

        // PUT api/values/5
        public void Put(int id, [FromBody]string value)
        {
        }

        // DELETE api/values/5
        public void Delete(int id)
        {
        }
    }

Oh yeah, I added a model....

 public class Employee
    {
        public System.Guid EmployeeUUID { get; set; }
        public string SSN { get; set; }
        public string LastName { get; set; }
        public string FirstName { get; set; }
        public System.DateTime? CreateDate { get; set; }
        public System.DateTime HireDate { get; set; }
    }

So those are the main pieces (or download the code in the link to have it all).

I cannot figure out why I get a GenericPrincipal in the webapi custom authorizeattribute, but the mvc custom authorizeattribute works fine.

So if you get the download or work in my samples, the triggering mechanism is "bool invokeFormsAuthenticationTicketCode = true;" and alternating between true and false.

Hints: set breakpoints on the lines "issueWasHit = true;"....that is where the issue occurs (duh).

Here are my references/nuget packages in case of any version questions. The MVC4 app was created against DotNet FW 4.5.2


















  ..\packages\EntityFramework.5.0.0\lib
et45\EntityFramework.dll


  True
  ..\packages\Microsoft.Web.Infrastructure.1.0.0.0\lib
et40\Microsoft.Web.Infrastructure.dll


  True
  ..\packages\Microsoft.AspNet.Mvc.FixedDisplayModes.1.0.0\lib
et40\Microsoft.Web.Mvc.FixedDisplayModes.dll


  ..\packages\Newtonsoft.Json.4.5.11\lib
et40\Newtonsoft.Json.dll




  ..\packages\Microsoft.AspNet.WebApi.Client.4.0.20710.0\lib
et40\System.Net.Http.Formatting.dll




  True
  ..\packages\Microsoft.AspNet.WebPages.2.0.20710.0\lib
et40\System.Web.Helpers.dll


  ..\packages\Microsoft.AspNet.WebApi.Core.4.0.20710.0\lib
et40\System.Web.Http.dll


  ..\packages\Microsoft.AspNet.WebApi.WebHost.4.0.20710.0\lib
et40\System.Web.Http.WebHost.dll


  True
  ..\packages\Microsoft.AspNet.Mvc.4.0.20710.0\lib
et40\System.Web.Mvc.dll


  ..\packages\Microsoft.AspNet.Web.Optimization.1.0.0\lib
et40\System.Web.Optimization.dll


  ..\packages\Microsoft.AspNet.Providers.Core.1.2\lib
et40\System.Web.Providers.dll


  True
  ..\packages\Microsoft.AspNet.Razor.2.0.20715.0\lib
et40\System.Web.Razor.dll


  True
  ..\packages\Microsoft.AspNet.WebPages.2.0.20710.0\lib
et40\System.Web.WebPages.dll


  True
  ..\packages\Microsoft.AspNet.WebPages.2.0.20710.0\lib
et40\System.Web.WebPages.Deployment.dll


  True
  ..\packages\Microsoft.AspNet.WebPages.2.0.20710.0\lib
et40\System.Web.WebPages.Razor.dll


  True
  ..\packages\Microsoft.AspNet.WebApi.Tracing.4.0.0\lib
et40\System.Web.Http.Tracing.dll


  True
  ..\packages\Microsoft.AspNet.WebApi.OData.4.0.0\lib
et40\System.Web.Http.OData.dll


  True
  ..\packages\Microsoft.Data.Edm.5.2.0\lib
et40\Microsoft.Data.Edm.dll


  True
  ..\packages\Microsoft.Data.OData.5.2.0\lib
et40\Microsoft.Data.OData.dll


  True
  ..\packages\System.Spatial.5.2.0\lib
et40\System.Spatial.dll



  True
  ..\packages\WebGrease.1.3.0\lib\WebGrease.dll


  True
  ..\packages\WebGrease.1.3.0\lib\Antlr3.Runtime.dll

granadaCoder · Accepted Answer

So the

    protected void Application_PostAuthenticateRequest

method runs twice. Once for the MVC, once for the WebApi. The cookies are empty when the Application_PostAuthenticateRequest method runs for the WebApi.

The fix was to pass the cookies (or my specific cookie) to the WebApi call. (Note the/extra code revolving around CookieContainer )

Here is the Mvc passing (the specific) cookie to the WebApi

   public class HomeController : Controller
    {

        public ActionResult Index()
        {

            /* the below is simulating a user-login... the main-thing is that it is setting a "FormsAuthentication.FormsCookieName" cookie */

            Employee e = new Employee();
            e.SSN = "999-99-9999";

            string serializedUser = JsonConvert.SerializeObject(e,
                Formatting.None,
                new JsonSerializerSettings()
                {
                    ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore
                });

            /* so the point here is to just throw something in the "FormsAuthentication.FormsCookieName" cookie */
            FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                     1,
                     e.SSN,
                     DateTime.Now,
                     DateTime.Now.AddMinutes(15),
                     false,
                     serializedUser);

            string encTicket = FormsAuthentication.Encrypt(authTicket);
            HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
            Response.Cookies.Add(faCookie);

            /* cookie is in place, now redirect */

            return RedirectToAction("MyHomeControllerAlternateActionResult");
        }

        [MyCustomMvcAuthorizeAttribute]
        public ActionResult MyHomeControllerAlternateActionResult()
        {
            IEnumerable modelViaWay1 = null;
            ////////IEnumerable modelViaWay2 = null;
            ////////IEnumerable modelViaWay3 = null;
            string json = string.Empty;

            CookieContainer cookieContainer = new CookieContainer();
            HttpClientHandler handler = new HttpClientHandler
            {
                UseCookies = true,
                UseDefaultCredentials = true,
                CookieContainer = cookieContainer
            };
            foreach (string cookiename in Request.Cookies)
            {
                if (cookiename.Equals(FormsAuthentication.FormsCookieName, StringComparison.OrdinalIgnoreCase))
                {
                    var cookie = Request.Cookies[cookiename];
                    cookieContainer.Add(new Cookie(cookie.Name, cookie.Value, cookie.Path, "localhost"));
                }
            }

            using (var client = new HttpClient(handler))
            {
                string valuesControllerUrl = Url.RouteUrl(
                    "DefaultApi",
                    new { httproute = "", controller = "Values" }, /* ValuesController */
                    Request.Url.Scheme
                );

                modelViaWay1 = client
                            .GetAsync(valuesControllerUrl)
                            .Result
                            .Content.ReadAsAsync>().Result;

                ////////HttpResponseMessage response = client.GetAsync(valuesControllerUrl).Result;
                ////////json = response.Content.ReadAsStringAsync().Result;

                ////////modelViaWay2 = JsonConvert.DeserializeObject>(json);
                ////////modelViaWay3 = response.Content.ReadAsAsync>().Result;

            }

            return View(); /* this will throw a "The view 'MyHomeControllerAlternateActionResult' or its master was not found or no view engine supports the searched locations" error, but that's not the point of this demo. */
        }
    }

And now my Application_PostAuthenticateRequest looks normal again.

    protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
            HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];

            if (authCookie != null)
            {
                /* we found the cookie set in the HomeController-Index (which simulates a user-successful login */
                FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);

                Employee empFromCookie = JsonConvert.DeserializeObject(authTicket.UserData);
                if (null == empFromCookie)
                {
                    throw new ArgumentNullException("Employee did not serialize from Cookie correctly.");
                }


                /* so we know the simulation of the user-login "passed" because the cookie exists..lets set the MyCustomClaimsPrincipal */
                MyCustomClaimsIdentity iid = new MyCustomClaimsIdentity(new GenericIdentity("I_Started_In_Application_PostAuthenticateRequest.MyCustomClaimsIdentity.invokeFormsAuthenticationTicketCode = true"));
                MyCustomClaimsPrincipal princ = new MyCustomClaimsPrincipal(iid);

                Thread.CurrentPrincipal = princ;
                HttpContext.Current.User = princ;

            }

    }

Bottom Line.

When an MVC and WebApi are hosted (cohosted) in the same layer....cookies are not automatically sent to the WebApi. That was my issue.

WebApi Custom System.Web.Http.AuthorizeAttribute does not recognize custom ClaimsPrincipal

Answers (1)

Related Questions