SignalR integration with existing authorization

Question

I am working on how to integrate SignalR authorization attributes with a special authorization provider (called MVCAuthorization). I made a few rabbit holes trying to recreate the authorization provider for the hubs, but it turned out to be far too complicated. So I was wondering how I can integrate my existing controller and action resolution with my hubs and SignalR methods?

Answer 1

I realized that you can get an IAuthorization provider.

If you consider you as a hub as a controller and your methods as your actions, all you have to do is create a SignalR attribute that implements IAuthorizeHubConnection and IAuthorizeHubMethodInvocation

public class HubAuthorizeAttribute : Attribute, IAuthorizeHubConnection,IAuthorizeHubMethodInvocation { public virtual bool AuthorizeHubConnection(HubDescriptor hubDescriptor, Microsoft.AspNet.SignalR.IRequest request) { IAuthorizationProvider authorizationProvider = DependencyResolver.Current.GetService<IAuthorizationProvider>(); return authorizationProvider.IsAuthorizedController(hubDescriptor.Name); } public virtual bool AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext) { IAuthorizationProvider authorizationProvider = DependencyResolver.Current.GetService<IAuthorizationProvider>(); return authorizationProvider.IsAuthorizedAction(hubIncomingInvokerContext.MethodDescriptor.Hub.Name, hubIncomingInvokerContext.MethodDescriptor.Name); } } 

Then all you have to do is put the attribute in a hub or any methods you want to allow.

 [HubAuthorize] public class Message : Hub { public void Send(string message) { } } 

Answer 2

You must override existing methods in the pipeline

Check authorization in the SignalR attribute

http://www.asp.net/signalr/overview/signalr-20/security/hub-authorization

Overriding authorization AuthorizeHubMethodInvocation will allow you to authorize the request when overriding UserAuthorized with the possibility of authentication (you can check user roles, etc.

Inherit your AuthorizeAttribute HubAuthorizeAttribute and allow the constructor to take a list of roles

Here is a simple example of how to handle the roles http://www.jasonwatmore.com/post/2014/02/18/ASPNET-Web-API-2-Enum-Authorize-Attribute.aspx