MVC equivalent of SecurityCheck Pipeline Processor

Question

What is the pipeline processor responsible for redirecting the user to the login page if they do not have access to the page being loaded? In a Sitecore webforms solution, this is handled by the SecurityCheck pipeline processor, but what is it in a Sitecore MVC solution since the RenderLayout pipeline does not execute?

Answer 1

Like Mark Cassidy mentioned above, <mvc.requestBegin> would be a close "equivalent". I ran into a similar situation wanting non-authenticated users to be redirected to the <site loginPage="/login">. The only caveat I had was that I needed some custom logic to create virtual users based on their IP address (site to site VPN), so I decided to extend the Sitecore.Layout.RenderLayout.SecurityCheck like so:

namespace YourNamespace.Custom
{
  public class InternalSecurityCheck : SecurityCheck
  {
    public virtual void Process(RequestBeginArgs args)
    {
        Assert.ArgumentNotNull(args, "args");
        Profiler.StartOperation("Check security access to page.");

        if (!HasAccess() || Context.User.LocalName.ToLower().Equals("anonymous"))
        {
            //logic for checking IP and creating virtual user if internal
            CreateVirtualUserIfInternal(); 
        }

        if (!HasAccess())
        {
            args.AbortPipeline();
            var loginPage = GetLoginPage(Context.Site);
            if (loginPage.Length > 0)
            {
                var urlString = new UrlString(loginPage);
                if (Settings.Authentication.SaveRawUrl)
                {
                    urlString.Append("url", HttpUtility.UrlEncode(Context.RawUrl));
                }

                var absolutePath = HttpContext.Current.Request.Url.AbsolutePath;
                if (!string.IsNullOrEmpty(absolutePath))
                {
                    urlString["returnUrl"] = absolutePath;
                }

                Tracer.Info("Redirecting to login page \"" + loginPage + "\".");

                WebUtil.Redirect(urlString.ToString(), false);
            }
            else
            {
                Tracer.Info("Redirecting to error page as no login page was found.");
                WebUtil.RedirectToErrorPage("Login is required, but no valid login page has been specified for the site (" + Context.Site.Name + ").", false);
            }
        }

        Profiler.EndOperation();
    } 

The above code should also preserve the return url if a page is bookmarked or session expires while visiting. I think the only remaining piece, after extending the SecurityCheck is binding it to the <mvc.requestBegin:

<mvc.requestBegin>
  <processor type="YourNamespace.Custom.InternalSecurityCheck, YourNamespace.Web" />
</mvc.requestBegin>

(https://community.sitecore.net/developers/f/8/t/2808 assisted me thru some of this). Hope this is helpful.

Answer 2

The one that mimics it most closely, is the <mvc.requestBegin> pipeline. Essentially, MVC will break off and start processing here, where the traditional would have continued to call <renderLayout>

Also - since you're specifically asking about the SecurityCheck functionality that resides in <renderLayout>, be aware that some of this functionality has not made it correctly to the MVC sister pipelines at this point. Specifically the MVC SiteSecurityChecker does not respect requireLogin. If this is the root issue you're looking into, I have it registered as a bug with Sitecore Support - public reference 93728. They can provide you with a hotfix for it.

From Sitecore.MVC.config

  <httpRequestBegin>
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.DisplayFatalErrors, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.IgnoreList, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferRoutedRequest, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferControllerRequest, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.LayoutResolver, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferMvcLayout, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.LayoutResolver, Sitecore.Kernel']" />
  </httpRequestBegin>

Which then leads to

  <mvc.requestBegin>
    <processor type="Sitecore.Mvc.Pipelines.Request.RequestBegin.SetupPageContext, Sitecore.Mvc"/>
    <processor type="Sitecore.Mvc.Pipelines.Request.RequestBegin.ExecuteFormHandler, Sitecore.Mvc"/>
  </mvc.requestBegin>

Answer 3

When I traced this through for a recent project, I found that the ExecuteRequest (as part of the HttpRequestBegin pipeline) did the redirection on invalid credentials. This is the line in my Sitecore 8.1 Sitecore.config file.

<processor type="Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel"/>

I'm not sure if there's a specific MVC pipeline or if the above pipeline handles MVC execution/checking as well.