SaifAuthorizeAttribute¶

Sealed authorization filter that grants access when the current user satisfies any one of the roles declared on the attribute ([SaifAuthorize("RoleA", "RoleB")]), and otherwise logs a SecurityException and redirects to a hard-coded error URL.

Purpose¶

Sealed authorization filter that grants access when the current user satisfies any one of the roles declared on the attribute ([SaifAuthorize("RoleA", "RoleB")]), and otherwise logs a SecurityException and redirects to a hard-coded error URL.
Depends on property-injected IUserProfileService, ILogService, and IEnvironmentService; see security-authorization.md for the authorization architecture.

Context¶

Namespace: SAIF.Web.Mvc
Assembly/package: SAIF.Framework.Web.Mvc (source-shipping NuGet package)
Kind: sealed class (MVC authorization filter)

Public members¶

Member	Signature	Purpose
UserProfileService	`public IUserProfileService UserProfileService { get; set; }`	Property-injected service used to resolve the current system user and evaluate role membership.
LogService	`public ILogService LogService { get; set; }`	Property-injected service used to log denied authorization attempts.
EnvironmentService	`public IEnvironmentService EnvironmentService { get; set; }`	Property-injected service used to resolve the current user id.
SaifAuthorizeAttribute(params string[] roles)	`public SaifAuthorizeAttribute(params string[] roles)`	Declares the set of roles that satisfy authorization; an empty set authorizes everyone.
SaifAuthorizeAttribute(bool forceProductionRole, params string[] roles)	`public SaifAuthorizeAttribute(bool forceProductionRole, params string[] roles)`	Stores the declared role set (trimmed and comma-joined into `Roles`) and retains `forceProductionRole`, so that when `AuthorizeCore` later evaluates `user.IsAuthorized(role, forceProductionRole)` the downstream user-profile check is forced to evaluate production-role names regardless of the current runtime environment.
AuthorizeCore(HttpContextBase)	`protected override bool AuthorizeCore(HttpContextBase httpContext)`	Returns whether the current user satisfies any declared role; see the "Authorize a request against SAIF roles" operation.
HandleUnauthorizedRequest(AuthorizationContext)	`protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)`	Logs the denial and redirects to the error page; see the "Handle an unauthorized request" operation.

Behavioral notes¶

Role satisfaction is OR semantics — any one satisfied role authorizes the request (see BR-18).

Constraints and usage notes¶

The unauthorized redirect uses a hard-coded literal URL rather than Constants.ErrorUrl, so it will not track future changes to that constant.

Sources¶

src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs