current community

your communities

more stack exchange communities

Stack Exchange
tour help
careers 2.0
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 4 down vote favorite
1

We are using the HttpModule to hook in to the FormsAuthenticationModule and subscribe to the Authenticate event. When we use web forms this event fires in the module. When we are using MVC this event is not firing.

I have tried using the [Authorize] attribute on the Controllers and location in web.config (even though this isn't best practice) to try and get this event to fire but it still does not.

The event does fire when using the Cassini webserver but does not fire on IIS 7.5 or IIS Express. We are running ASP.NET MVC 2 using .NET 3.5

EDIT

The Authentication event fires when we request a .aspx or .ashx file. If we request an extensionless file or a .css or .js it does not fire either.

An new ASP.NET MVC application will fire this event for every file requested.

Any suggestions?

share|improve this question
    
Is Forms authentication working correctly in MVC? –  Max Toro Jan 31 '12 at 19:51
    
@MaxToro yes. If I have already navigated to an aspx page the custom HttpHandlder will have already run and setup the forms cookie. –  Joel Cunningham Jan 31 '12 at 20:00
add comment

3 Answers

up vote 2 down vote accepted

Our web.config was missing the runAllManagedModulesForAllRequests="true" from the modules element in system.webServer. Once this was added all web requests receive the Authorisation event from FormsAuthenticationModule.

<system.webServer>
    ....
    <modules runAllManagedModulesForAllRequests="true">
    ....
</system.webServer>
share|improve this answer
    
Accept your answer. –  Amar Palsapure Feb 1 '12 at 3:22
    
@AmarPalsapure I would have but SO doesn't allow you to do that for a day. –  Joel Cunningham Feb 1 '12 at 5:28
    
hmmm I didn't know that, haven't asked question so far. –  Amar Palsapure Feb 1 '12 at 5:33
add comment
up vote 2 down vote

Navigating to an aspx page does not test if forms authentication is working in MVC, you have to navigate to a route. I saw your answer and that's what I had in mind. Instead of the inefficient runAllManagedModulesForAllRequests="true" I suggest removing the managedHandler precondition:

     <remove name="FormsAuthentication"/>
     <add name="FormsAuthentication" preCondition="" type="System.Web.Security.FormsAuthenticationModule"/>

     <remove name="DefaultAuthentication"/>
     <add name="DefaultAuthentication" preCondition="" type="System.Web.Security.DefaultAuthenticationModule"/>

     <remove name="RoleManager"/>
     <add name="RoleManager" preCondition="" type="System.Web.Security.RoleManagerModule"/>

     <remove name="UrlAuthorization"/>
     <add name="UrlAuthorization" preCondition="" type="System.Web.Security.UrlAuthorizationModule"/>

     <remove name="UrlRoutingModule-4.0"/>
     <add name="UrlRoutingModule-4.0" preCondition="runtimeVersionv4.0" type="System.Web.Routing.UrlRoutingModule"/>
share|improve this answer
    
Thanks for this answer. Many people recommend turning runAllManagedModulesForAllRequests off but don't list these modules which are needed for most MVC sites to work –  Andrew Harry Oct 2 '12 at 15:42
add comment
up vote 0 down vote

I don't think it's the best way to solve it, but I'm also using a combination of MVC and formpages and set all the authorisation in the web.config

<location path="[path]"> 
   <system.web>
     <authorization>
        <allow users="[username]" roles="[role]"/>
        <deny users="*"/>
      </authorization>
   </system.web>
</location>
share|improve this answer
    
I have tried this to see if it helped but it does not. It is also a security risk to configure security this way for MVC pages. –  Joel Cunningham Jan 31 '12 at 20:00
    
Just for personal information, which security risk would form using this method? Wonder how come it does not work for you. –  DerDee Feb 1 '12 at 10:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.