Asp.Net MVC SSO - Deny Access to DB User

Question

I am introducing SSO to a legacy application. One existing functionality that I need to manage is to check if a user can access the application after they have signed in. Previously, if they logged in, their account would be checked against a db table and they would be logged out of the system with a message saying they had to contact support if their access was denied. I am looking for the same functionality if possible on new SSO login. So, a snippet of the code below. Any suggestions would be appreciated.

 Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = OnAuthenticationFailed,
                SecurityTokenValidated = (context) =>
                {
                    ClaimsIdentity identity = context.AuthenticationTicket.Identity;

                    // check the database if the user is locked from accessing the system
                    var userEmail = identity.FindFirst("preferred_username").Value;

                    var currentUser = UsersTable.Where(user => user.Email == userEmail);

                    if (currentUser != null ) 
                    {
                        if (currentUser.AccessLocked)
                        {
                            at this point I need to prevent the user for using the system. My preferred option would be to
                            Force logout, and redirect back to the login page, with a message saying that user access is locked

                            The other option 
                            // 2 - Add Roles on each of the controller (IsActive) and add a Claim Role Type for a user who does have access
                            identity.AddClaim(new Claim(ClaimTypes.Role, "IsActive"));
                            I have tried this, but I get stuck in a authorisation loop when the user doesn not have the Role
                        }
                    }
                }
            }

Gary Archer Gary Archer · Accepted Answer · 2020-06-02T18:54:47

The difference after integrating SSO is that you now have 2 step behaviour:

Authentication is outsourced to the SSO system for multiple apps, and the user may only have rights to a subset of these
You then apply Application Specific Authorization to see whether the user has rights to use a particular app or particular views

The most standard solution is to avoid signing the user out, which is likely to lead to a redirect loop or other technical complexity. Instead you should aim to redirect such users to an Access Denied Page within the app.

In C# I would use a filter + claims based solution to achieve these goals, as you suggest. However, you need to avoid using an 'authentication filter', whose failure action is to redirect the user.

Asp.Net MVC SSO - Deny Access to DB User

1 Answers