ASP.NET MVC - Allow internal anonymous users, require windows authentication on external

Question

Is it possible to setup Authorization based on the zone of the request? Basically it is an intranet type application, with only little sensitive information.

If the request is performed from within the organization, it is fine to allow anonymous users.

However if it is an external request, they should get the 401 Authorization challenge. External requests are coming from a single firewall, so an IP/IP range should be fine to specify if it is an external or internal request.

Currently it is configured for Windows authentication in the web.config file.

<authentication mode="Windows" />
<authorization>
  <deny users="?" />
</authorization>

Darin Dimitrov Darin Dimitrov · Accepted Answer · 2012-10-09T15:25:51

It would be easier to handle this rule directly at your firewall.

As an alternative you could configure IP Security at your IIS level and filter by client IP.

But if you have no control over the firewall you could write a custom Authorize attribute that will check the incoming IP address and allow/deny the request:

public class IpBasedAuthorizeAttribute: AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var ip = httpContext.Request.UserHostAddress;
        return IsAllowed(ip);
    }

    private bool IsAllowed(string ip)
    {
        // TODO: do your checks here and return true or false
        // depending on whether the IP address is allowed to 
        // access the application or not
        throw new NotImplementedException();
    }
}

and then you could either decorate individual controllers/actions with this attribute or register it as a global authorization attribute if you want it to apply to all requests:

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new HandleErrorAttribute());
    filters.Add(new IpBasedAuthorizeAttribute());
}

ASP.NET MVC - Allow internal anonymous users, require windows authentication on external

1 Answers