Making ASP.NET MVC Windows Authentication With Role-Based Security Painless for Developers

I’ve always been a bit of a Windows Authentication hater for all the wrong reasons.  If I want to change my roles, I have to change my group memberships in Active Directory.  The network administrator never wants to give me access so I have to make a request and wait.  In the alternative, I can get a number of different users setup and logon to the computer as one of them every time I want to test different security settings.  If my development box is not part of the domain, I can manipulate my local security settings, but that is not always an option either.  I can also set things up so my account doesn’t have access to the application.  This way I “simply” type in the credentials of the user I want to test under each time I fire up the web application. It is just painful to work with Windows Authentication on a developer box

Unfortunately, my current team has to deal with Windows Authentication on our current project and was running into these headaches on a daily basis.  I finally put together a simple solution that swaps in a configuration-based GenericPrincipal for developers that allows them to set up any role memberships they want locally without impacting Active Directory or the server deployment environment.  It’s all controlled from a single configuration setting contained in the appSettings section of the web.config:

<!-- Comma-delimited list of roles to be used in development environment (Windows authentication off).-->
<add key="Roles" value="AutobahnAdministrators" />

If the configuration key is present, the AutenticateRequest event in global.asax injects a GenericPrincipal with the configured role memberships:

protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    var roles = ConfigurationManager.AppSettings["Roles"];
    if (!string.IsNullOrEmpty(roles))
    {
        var genericIdentity = new GenericIdentity("developer");
        HttpContext.Current.User = new GenericPrincipal(genericIdentity, roles.Split(','));
    }
}

Optional — Allow IoC Container to Inject Correct IPrincipal

Our team uses Castle Windsor to inject an IPrincipal into our controllers to perform role checks. This allows us to avoid directly accessing the HttpContext, which makes unit testing much easier. I’m sure the code below could be adapted to work with any of the popular IoC libraries.

public class Installer : IWindsorInstaller
{
    protected override void RegisterComponents(IWindsorContainer container, IConfigurationStore store)
    {
        //This allows us to inject an IPrincipal into any controller.
        //Will be based on configuration if:
        //  1) Anonymous authentication is enabled (Windows authentication is disabled)
        //  2) AppSettings["Roles"] is a comma-delimited list of roles to assign
        //
        // Throws exception if anonymous authentication is in use and AppSettings/@key=Roles is not configured
        container.Register(Component.For().UsingFactoryMethod((kernel, creationContext) =>
            {
                //if this is a generic principal, it was injected based on the configuration so we can just use it
                if (HttpContext.Current.User is GenericPrincipal)
                {
                    return HttpContext.Current.User;
                }
                //This is only used in integration test scenarios using the container.  If you are running the web app, the proper generic identity from the web.config was injected in global.asax AuthenticateRequest()
                var roles = ConfigurationManager.AppSettings["Roles"];
                if (!string.IsNullOrEmpty(roles))
                {
                    return new GenericPrincipal(new GenericIdentity("developer"), roles.Split(','));
                }

                //if there is not configuration and this is a windows principal, then just return it
                if (HttpContext.Current.User is WindowsPrincipal)
                {
                    return HttpContext.Current.User;
                }

                throw new HttpException(401, "Windows authentication must be on or AppSettings/@key=Roles must be configured");
            }).LifestylePerWebRequest());
    }
}