Windows Authentication - require additional password for special users

Question

I am developing an intranet asp.net core web api application. The requirements for authentications are:

• REQ1 - when user which is trying to access the website is not in Active Directory's special group (let's name it "commonUsers") it is simply not authorized
• REQ2 - when user which is trying to access the website is in Active Directory's group "commonUsers" is is authorized and a web resource is returned
• REQ3 - when user which is trying to access the website is in Active Directory's group "superUser", it need to be prompted for his domain password once again (because it tries to access some very restricted resources)

Now, what I have so far:

• My service is hosted using http.sys server in order to support windows authentication.

• I am using claims transformer middlewere in order to check the user's Active Directory group, let's say something like this:

  public class ClaimsTransformer : IClaimsTransformation {
  private readonly IAuthorizationService _authorizationService;
  public ClaimsTransformer(IAuthorizationService authorizationService)
  {
      _authorizationService = authorizationService;
  }
  
  public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
  {
      _authorizationService.Authorize(principal as  IHmiClaimsPrincipal);
      return Task.FromResult(principal);
  }}
  

• I have specified a special policies also in my service configuration, for instance something like that:

  services.AddAuthorization(options =>
      {
          options.AddPolicy("TestPolicy", policy => 
                                     policy.RequireClaim(ClaimTypes.Role, "TestUser"));
          options.AddPolicy("TestPolicy2", policy => 
                                     policy.RequireClaim(ClaimTypes.Role, "SuperUser"));
      });

• I am using [Authorize] attribute with specific policy in order to restrict access to specific resources based on policies

Now the question is, how should I satisfy REQ3?

Answer 1

I think I would try to use MVC Filters : https://docs.microsoft.com/en-us/aspnet/core/mvc/controllers/filters?view=aspnetcore-2.2#authorization-filters

Filters run after all Middleware, but before the Action. This will allow you to control the redirect to credentials page just for specific actions or controllers. Whilst normally this is not the recommended method for authorization, I think it fits your requirements for a hybrid secondary authentication.

public class SuperUserFilter : Attribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        if (context.HttpContext.Request.Cookies.TryGetValue("SuperUserCookie", out string cookieVal))
        {
            if (!IsValidCookie(cookieVal))
                context.Result = LoginPage(context);

        }
        else
        {
            context.Result = LoginPage(context);
        }
    }

    private bool IsValidCookie(string cookieVal)
    {
        //validate cookie value somehow
        // crytpographic hash, store value in session, whatever
        return true;
    }

    private ActionResult LoginPage(AuthorizationFilterContext context)
    {
        return new RedirectToActionResult("SuperUser", "Login",
            new {redirectUrl = context.HttpContext.Request.GetEncodedUrl()});
    }
}

Then you create a Login Controller

public class LoginController : Controller
{    
    [HttpGet]    
    public IActionResult SuperUser(string redirectUrl)
    {
        // return a page to enter credentials
        // Include redirectUrl as field
    }

    [HttpPost]
    public IActionResult SuperUser(LoginData loginData)
    {
        // Validate User & Password
        Response.Cookies.Append("SuperUserCookie", "SomeValue");
        return Redirect(loginData.RedirectUrl);
    }
}

Then you can decorate specific actions (or controllers) as required:

public class MyController : Controller
{
    [HttpGet]
    [SuperUserFilter]
    public IActionResult MySensitiveAction()
    {
        // Do something sensitive
    }
}