Authentication / Login for Custom ServicesApiController

Question

I've created a custom API Controller that inherits from ServicesApiController. I've created also custom route and it all works fine.

Something like the following:

public class ExampleController : ServicesApiController
{
    public ActionResult Index()
    {
        return null;
    }
}

However I want to ensure that this is secured and doesn't expose my list of items to unauthorized users.

I was thinking of applying the same requirements as the ItemService and requiring use of the auth/login endpoint before requests can be made to my custom controller.

However after digging into the code for the ItemService with DotPeek I can't seem to find how this is implemented for the ItemService.

I thought it would be using a custom filter that checks whether user is authenticated.

I've read over the docs here:

https://doc.sitecore.net/sitecore_experience_platform/developing/developing_with_sitecore/sitecoreservicesclient/sitecoreservicesclient_security?roles=developer

And it says:

Sitecore.Services.Client provides two layers of security:

• A security policy that applies to all Sitecore.Services.Client requests.
• Individual filters that can add additional requirements on requests that are to be executed.

So this also suggests that.

I'd appreciate any guidance on if there is a filter I can use to require login or if I need to create my own that does something like:

public override void OnAuthorization(HttpActionContext actionContext)
{
   if (Context.User.IsAuthenticated){
       return;
   }
   actionContext.Response = actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Unauthorized Access");
   base.OnAuthorization(actionContext);
}

Or is there a better way to do this?

Other Info: Sitecore 8.2. Update 6

Answer 1

I would go with custom Authentication/Authorization Filter:

public class AuthorizedUser : AuthorizationFilterAttribute
    {
        private readonly string _user;

        public AuthorizedUser(string user)
        {
            _user = user;
        }
        public override void OnAuthorization(HttpActionContext actionContext)
        {
            base.OnAuthorization(actionContext);
            var context = Context.User;

            if ((context.IsAuthenticated && context.Name.Equals(_user)))
                return;

            actionContext.Response =
                actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized,
                    "Unauthorized Access; User is " + Context.User.LocalName);
        }
    } 

Then you need to decorate your method with this attribute:

[AuthorizedUser(@"sitecore\ServicesAPI")]

Your class would look like this:

[ServicesController]    
public class ExampleController : ServicesApiController
{
    [AuthorizedUser(@"sitecore\ServicesAPI")]
    public ActionResult Index()
    {
        return null;
    }
}

Some config changes are also needed to make this working. Example codes and config files can be found in really nice post by Boris Brodsky: http://borisbrodsky.com/sitecore/sitecore-webapi-servicesapicontroller-and-jwt-token-security/

Answer 2

Since you say you were thinking of requiring the use of the auth/login endpoint before requests can be made to your custom controller, what you can do is add the Authorize filter as an attribute to the controller or specific actions like this:

[Authorize]
public class ExampleController : ServicesApiController
{
    public ActionResult Index()
    {
        return null;
    }
}

That will only exclude access to anonymous users, in case you want to be more specific you can use something like this:

• [Authorize(Users="Alice,Bob")]
• [Authorize(Roles="Administrators")]

And then you can authenticate through the sitecore/api/ssc/auth/login endpoint.