public ActionResult HandleSecurityFor(string controllerName, string actionName)
{
if (controllerName.IsNullOrEmpty())
throw new ArgumentException("Controllername must not be null or empty", "controllerName");
if (actionName.IsNullOrEmpty())
throw new ArgumentException("Actionname must not be null or empty", "actionName");
var configuration = ServiceLocator.Current.Resolve<ISecurityConfiguration>();
var policyContainer = configuration.PolicyContainers.GetContainerFor(controllerName, actionName);
if (policyContainer != null)
{
var context = ServiceLocator.Current.Resolve<ISecurityContext>();
var results = policyContainer.EnforcePolicies(context);
if (results.Any(x => x.ViolationOccured))
{
var result = results.First(x => x.ViolationOccured);
var policyViolationException = new PolicyViolationException(result);
var violationHandlerSelector = ServiceLocator.Current.Resolve<IPolicyViolationHandlerSelector>();
var matchingHandler = violationHandlerSelector.FindHandlerFor(policyViolationException) ?? new ExceptionPolicyViolationHandler();
return matchingHandler.Handle(policyViolationException);
}
return null;
}
if (configuration.IgnoreMissingConfiguration)
return null;
throw ExceptionFactory.CreateConfigurationErrorsException("Security has not been configured for controller {0}, action {1}".FormatWith(controllerName, actionName));
}
public ActionResult Handle(PolicyViolationException exception)
{
Log.Warn(exception);
// We should really use 401 - Unauthorized, however with windows authentication, that keeps asking for credentials
// We can't have this as the user is already authenticated
return new RedirectResult("~/Error/403.aspx");
}
public ActionResult Handle(PolicyViolationException exception)
{
//return new RedirectToRouteResult("Account/LogIn",
// new RouteValueDictionary { { "error", "You have to be logged in order to view this website" } });
return new RedirectToRouteResult(new RouteValueDictionary(new { controller = "Account", action = "LogIn", area = "" }));
}
public ActionResult Handle(PolicyViolationException exception)
{
RouteValueDictionary rvd = new RouteValueDictionary();
rvd["controller"] = "AdminAccount";
rvd["Action"] = "Index";
rvd["Area"] = "Admin";
return new RedirectToRouteResult(rvd);
}
public ActionResult Handle(PolicyViolationException exception)
{
RouteValueDictionary routeValueDictionary = new RouteValueDictionary();
routeValueDictionary["action"] = IdentitySettings.LogInPageAction;
routeValueDictionary["controller"] = IdentitySettings.LogInPageController;
routeValueDictionary["returnurl"] = HttpContext.Current.Request.RawUrl;
return new RedirectToRouteResult(routeValueDictionary);
}
public System.Web.Mvc.ActionResult Handle(PolicyViolationException exception)
{
if (Helpers.SecurityHelper.UserIsAuthenticated())
{
return new ViewResult { ViewName = "Error" };
}
else
{
return new HttpUnauthorizedResult(exception.Message);
}
}
public ActionResult Handle(PolicyViolationException exception)
{
//TODO: want to record where we were trying to go
return new RedirectToRouteResult(new RouteValueDictionary(new
{
action = "ChooseElection",
controller = "Dashboard",
area = ""
}));
}
public ActionResult HandleSecurityFor(string controllerName, string actionName, ISecurityContext securityContext)
{
if (controllerName.IsNullOrEmpty())
{
throw new ArgumentException("Controllername must not be null or empty", nameof(controllerName));
}
if (actionName.IsNullOrEmpty())
{
throw new ArgumentException("Actionname must not be null or empty", nameof(actionName));
}
if (securityContext == null)
{
throw new ArgumentNullException(nameof(securityContext), "Security context must not be null");
}
var runtime = securityContext.Runtime;
Publish.RuntimeEvent(() => "Handling security for {0} action {1}.".FormatWith(controllerName, actionName), securityContext);
var policyContainer = runtime.PolicyContainers.GetContainerFor(controllerName, actionName);
if (policyContainer != null)
{
return(Publish.RuntimeEvent(() =>
{
var results = policyContainer.EnforcePolicies(securityContext);
if (results.Any(x => x.ViolationOccured))
{
var result = results.First(x => x.ViolationOccured);
var policyViolationException = new PolicyViolationException(result, securityContext);
var violationHandlerSelector = ServiceLocator.Current.Resolve <IPolicyViolationHandlerSelector>();
var matchingHandler = violationHandlerSelector.FindHandlerFor(policyViolationException) ?? new ExceptionPolicyViolationHandler();
Publish.RuntimeEvent(() => "Handling violation with {0}.".FormatWith(matchingHandler.GetType().FullName), securityContext);
return matchingHandler.Handle(policyViolationException);
}
return null;
}, result => result == null ? "Done enforcing policies. Success!" : "Done enforcing policies. Violation occured!", securityContext));
}
if (runtime.ShouldIgnoreMissingConfiguration)
{
Publish.RuntimeEvent(() => "Ignoring missing configuration.", securityContext);
return(null);
}
throw ExceptionFactory.CreateConfigurationErrorsException("Security has not been configured for controller {0}, action {1}".FormatWith(controllerName, actionName));
}
public ActionResult Handle(PolicyViolationException exception)
{
if (SecurityProvider.UserIsAuthenticated())
{
return new ViewResult { ViewName = ViewName };
}
else
{
var rvd = new System.Web.Routing.RouteValueDictionary();
if (System.Web.HttpContext.Current.Request.RawUrl != "/")
rvd["ReturnUrl"] = System.Web.HttpContext.Current.Request.RawUrl;
rvd["controller"] = "Account";
rvd["action"] = "LogOn";
rvd["area"] = "";
return new RedirectToRouteResult(rvd);
}
}
public ActionResult HandleSecurityFor(string controllerName, string actionName, ISecurityContext securityContext)
{
if (controllerName.IsNullOrEmpty())
{
throw new ArgumentException("Controllername must not be null or empty", "controllerName");
}
if (actionName.IsNullOrEmpty())
{
throw new ArgumentException("Actionname must not be null or empty", "actionName");
}
if (securityContext == null)
{
throw new ArgumentNullException("securityContext", "Security context must not be null");
}
var configuration = ServiceLocator.Current.Resolve <ISecurityConfiguration>();
var policyContainer = configuration.PolicyContainers.GetContainerFor(controllerName, actionName);
if (policyContainer != null)
{
var results = policyContainer.EnforcePolicies(securityContext);
if (results.Any(x => x.ViolationOccured))
{
var result = results.First(x => x.ViolationOccured);
var policyViolationException = new PolicyViolationException(result);
var violationHandlerSelector = ServiceLocator.Current.Resolve <IPolicyViolationHandlerSelector>();
var matchingHandler = violationHandlerSelector.FindHandlerFor(policyViolationException) ?? new ExceptionPolicyViolationHandler();
return(matchingHandler.Handle(policyViolationException));
}
return(null);
}
if (configuration.IgnoreMissingConfiguration)
{
return(null);
}
throw ExceptionFactory.CreateConfigurationErrorsException("Security has not been configured for controller {0}, action {1}".FormatWith(controllerName, actionName));
}
public ActionResult HandleSecurityFor(string controllerName, string actionName, ISecurityContext securityContext)
{
if (controllerName.IsNullOrEmpty()) throw new ArgumentException("Controllername must not be null or empty", "controllerName");
if (actionName.IsNullOrEmpty()) throw new ArgumentException("Actionname must not be null or empty", "actionName");
if (securityContext == null) throw new ArgumentNullException("securityContext", "Security context must not be null");
var runtime = securityContext.Runtime;
Publish.RuntimeEvent(() => "Handling security for {0} action {1}.".FormatWith(controllerName, actionName), securityContext);
var policyContainer = runtime.PolicyContainers.GetContainerFor(controllerName, actionName);
if (policyContainer != null)
{
return Publish.RuntimeEvent(() =>
{
var results = policyContainer.EnforcePolicies(securityContext);
if (results.Any(x => x.ViolationOccured))
{
var result = results.First(x => x.ViolationOccured);
var policyViolationException = new PolicyViolationException(result, securityContext);
var violationHandlerSelector = ServiceLocator.Current.Resolve<IPolicyViolationHandlerSelector>();
var matchingHandler = violationHandlerSelector.FindHandlerFor(policyViolationException) ?? new ExceptionPolicyViolationHandler();
Publish.RuntimeEvent(() => "Handling violation with {0}.".FormatWith(matchingHandler.GetType().FullName), securityContext);
return matchingHandler.Handle(policyViolationException);
}
return null;
}, result => result == null ? "Done enforcing policies. Success!" : "Done enforcing policies. Violation occured!", securityContext);
}
if (runtime.ShouldIgnoreMissingConfiguration)
{
Publish.RuntimeEvent(() => "Ignoring missing configuration.", securityContext);
return null;
}
throw ExceptionFactory.CreateConfigurationErrorsException("Security has not been configured for controller {0}, action {1}".FormatWith(controllerName, actionName));
}
public IPolicyViolationHandler FindHandlerFor(PolicyViolationException exception)
{
var matchingHandler = _policyViolationHandlers.SingleOrDefault(handler => HandlerIsMatchForException(handler, exception));
return matchingHandler;
}
public ActionResult Handle(PolicyViolationException exception)
{
var returnUrl = HttpContext.Current.Request.Path;
return new RedirectToRouteResult(new RouteValueDictionary(new { action = "Checkpoint", controller = "Security", returnurl = returnUrl }));
}
public ActionResult Handle(PolicyViolationException exception)
{
return new RedirectToRouteResult(new RouteValueDictionary(new { controller = "Account", action = "LogIn", area = "" }));
}
public ActionResult Handle(PolicyViolationException exception)
{
throw exception;
}
public ActionResult Handle(PolicyViolationException exception)
{
return new RedirectToRouteResult("LogIn",
new RouteValueDictionary { { "error", "You don't have access here" } });
}
public ActionResult Handle(PolicyViolationException exception)
{
return new ViewResult { ViewName = "NoAutorizado", MasterName = "_Layout" };
}
public ActionResult Handle(PolicyViolationException exception)
{
//Log the violation, send mail etc. etc.
var rvd = new RouteValueDictionary(new
{
area = "",
controller = "Error",
action = "HttpForbidden",
});
return new RedirectToRouteResult(rvd);
}
public ActionResult Handle(PolicyViolationException exception)
{
Log.Warn(exception);
return new RedirectResult("~/Error/NoProgrammeAccess.aspx?Message=" + HttpUtility.UrlEncode(exception.Message));
}
public ActionResult Handle(PolicyViolationException exception)
{
return new HttpUnauthorizedResult(exception.Message);
}
public ActionResult Handle(PolicyViolationException exception)
{
return new RedirectToRouteResult("LogIn",
new RouteValueDictionary
{{"error", "You have to be logged in order to view this website"}});
}
public IPolicyViolationHandler FindHandlerFor(PolicyViolationException exception)
{
var matchingHandler = _policyViolationHandlers.SingleOrDefault(handler => HandlerIsMatchForException(handler, exception));
return(matchingHandler);
}
public ActionResult Handle(PolicyViolationException exception)
{
Log.Warn(exception);
return new RedirectResult(string.Format("~/Error/NoMarketAccess.aspx?Message={0}", HttpUtility.UrlEncode(exception.Message)));
}
public ActionResult Handle(PolicyViolationException exception)
{
Log.Warn(exception);
// A friendly page saying that this page hasn't been configured correctly
return new RedirectResult("~/Error/NoSecurity.aspx");
}
private static bool HandlerIsMatchForException(IPolicyViolationHandler handler, PolicyViolationException exception)
{
var expectedHandlerName = "{0}ViolationHandler".FormatWith(exception.PolicyType.Name);
var actualHandlerName = handler.GetType().Name;
return(expectedHandlerName == actualHandlerName);
}
private static bool HandlerIsMatchForException(IPolicyViolationHandler handler, PolicyViolationException exception)
{
var expectedHandlerName = "{0}ViolationHandler".FormatWith(exception.PolicyType.Name);
var actualHandlerName = handler.GetType().Name;
return expectedHandlerName == actualHandlerName;
}
public ActionResult Handle(PolicyViolationException exception)
{
var result = new HttpStatusCodeResult((int) HttpStatusCode.Unauthorized) as ActionResult;
var noRedirect = HttpContext.Current.Items["NoRedirect"];
if (noRedirect == null)
{
result = new RedirectToRouteResult(new RouteValueDictionary(new
{
controller = "Account",
action = "SignIn",
returnUrl = HttpContext.Current.Request.RawUrl
}));
}
return result;
}
public ActionResult Handle(PolicyViolationException exception)
{
throw exception;
}