Skip to main content

ASP.NET MVC Authorization via PowerShell

I have devised a way to build a PowerShell authorization script for ASP.NET MVC using a custom AuthorizeAttribute. It's ok, I'll give you a minute to let that settle in your mind...

Get over to the github and download the latest drop of PowerShell for ASP.NET. The System.Web.Mvc.PowerShellAuthorizationAttribute class provides you with the ability to run a PowerShell script to perform the authorization of the action or controller.

Usage is simple add the attribute to your action or controller like so:
  1. [PowerShellAuthorization("~/App_Data/Authorize-KillProcess.ps1")]  
  2. public ActionResult Kill(string computerName, uint pid)...  
And create a simple PowerShell script that returns $true or $false:
  1. param(  
  2.     [Parameter(Mandatory = $true)]  
  3.     $HttpContext,  
  4.   
  5.     [Parameter(Mandatory = $true)]  
  6.     $Principal,  
  7.   
  8.     [Parameter(Mandatory = $true)]  
  9.     $Action,  
  10.   
  11.     [Parameter(Mandatory = $true)]  
  12.     $RouteValues,  
  13.   
  14.     [switch$Test = $false  
  15. )  
  16.   
  17. process {  
  18.     [int]$RouteValues.pid -gt 4 `  
  19.        -and ($Principal.IsInRole('Administrators') `  
  20.             -or $RouteValues.ComputerName -like 'TEST-*')  
  21. }  
Welcome to the darkside.

Comments

  1. So... I guess I really like the fact that you *can* do this if you want (speaks to other possible admin you can do w/ PS), but I'm curious about that attribute; is that a real-world scenario?

    ReplyDelete
  2. Yes, I use that to control several actions and what people can do. It is a contextual authorization script. Since I have access to the information about the request, I can make contextual decisions on whether to allow the request or not. In this example I want to deny requests to kill a process PID that is <= 4, allow all people with the Administrators role (group) or let anyone kill a process on computers that begin with the name "TEST-". This keeps those constraints out of the actual action body.

    ReplyDelete
  3. This is a nice article..
    Its easy to understand ..
    And this article is using to learn something about it..

    c#, dot.net, php tutorial, Ms sql server

    Thanks a lot..!
    ri70

    ReplyDelete

Post a Comment

Popular posts from this blog

PowerShell SupportsShouldProcess Worst & Best Practices

This has been a very big discussion within the Scripting Games 2013 community and I want to add my two cents in an official blog post.

I've left several people comments on how they might be misunderstanding how SupportsShouldProcess works, but I also realize, everyone of these individuals has given me more insight into its use and perhaps, how it should best be utilized.

For those of you that don't know, SupportsShouldProcess is a parameter on the CmdletBinding attribute you can place on your cmdlets that automatically adds the -WhatIf and -Confirm parameters. These will naturally flow into other cmdlets you use that also SupportsShouldProcess, e.g. New-Item, Move-Item.

The major discussion has been around, should you just let the other cmdlets handle the $PSCmdlet.ShouldProcess feature, and if not how should you implement it. ShouldProcess has the following definitions.
OverloadDefinitions�����������������������������������������������������������������������������������������…

PowerShell Error Handling Behavior Debunked

Note: I am using simple error messages as an example, please reference the best practices and guidelines I outlined on when to use custom error messages.

I have been churning in my mind for the last few days all the entries in the 2013 Scripting Games and how they handle errors, or lack thereof.

I am coming to the conclusion through some testing that the simple fact of seeing a try..catch or throw statements does not mean there is proper error handling.

I've been testing several variations and forms of error handling, so lets start with the basics.
function Test-WriteError {      [CmdletBinding()] param()  "Test-WriteError::ErrorActionPreference = $ErrorActionPreference"Move-Item -Path 'C:\Does\Not\Exists.log' -Destination 'C:\No\Where'"Test-WriteError::End"}   Test-WriteError::ErrorActionPreference = Continue
Move-Item : Cannot find path 'C:\Does\Not\Exists.log' because it does not exist.
At line:6 char:5
+     Move-Item -Path 'C:\Does\N…

Generate Random SecureString Key

Ever need to encrypt a SecureString that can be used across multiple servers? I suggest storing this BASE64 value in a secure location only accessible by the account(s) that need to decrypt the SecureString.
$secret = 'secret1234'$key    = [Convert]::ToBase64String((1..32 |% { [byte](Get-Random -Minimum 0 -Maximum 255) }))  $encryptedSecret = ConvertTo-SecureString -AsPlainText -Force -String $secret | ConvertFrom-SecureString -Key ([Convert]::FromBase64String($key))  $encryptedSecret | Select-Object @{Name='Key';Expression={$key}},@{Name='EncryptedSecret';Expression={$encryptedSecret}} | fl  $ss = ConvertTo-SecureString -Key ([Convert]::FromBase64String($key)) -String $encryptedSecret(New-Object System.Management.Automation.PSCredential 'SECURESTRING',$ss).GetNetworkCredential().Password