asp.net web api role based authentication custom attribute check if user in role

Question

I was seeking on the internet a bit, but couldn't find exactly what I meant...

Could you please elaborate what exactly I'm doing wrong here and how can I actually accomplish what I need? Issue explained in code comment just below multiple strings.

um.FindByName(username) - of course gives me an error "The entity type ApplicationUser is not part of the model for the current context"

public class MyNewAuthenticationAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {


        if (actionContext.Request.Headers.Authorization == null)
        {
            base.OnAuthorization(actionContext);
        }
        else
        {
            string authenticationToken = actionContext.Request.Headers.Authorization.Parameter;
            string decodedToken = Encoding.UTF8.GetString(Convert.FromBase64String(authenticationToken));
            string[] usernamePasswordArray = decodedToken.Split(':');
            string username = usernamePasswordArray[0];
            string password = usernamePasswordArray[1];


            // Here is the issue. I need to check whether the user is in admin role....
            var um = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new WeatherAppDbEntities()));
            var user = um.FindByName(username);

            var isInRole = um.IsInRole(user.Id, "Admin");


            if (// User is admin)
            {

            }
            else
            {
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
            }
        }



    }

}

UPDATE:

Well it all works fine if i use: var um = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext())); in the new authentication attribute that i've created... Not really sure though what's the best practice to use ApplicationDbContext() with Ado.net data model created later

Answer 1

Like Stormcloak mentioned it seems that you have two or more DbContexts and therefore you are using more then one databases or connection strings.When creating Asp.Net MVC projects, tamplate comes with some models and controlers, as well as connection string named "DefaultConnection". Visual studio uses SQL Server Express and with connection string it generates database that will store information about users, so when you create your own database (" WeatherAppDb") you are basically working with two databases. How to prevent this?

1. When creating MVC project check Web.config file for <connectionStrings> tag, if you find something like tihs

 <add name="DefaultConnection" connectionString="Data Source=(LocalDb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\aspnet-MyMVCProject-20180127104017.mdf;Initial Catalog=aspnet-MyMVCProject-20180127104017;Integrated Security=True"
      providerName="System.Data.SqlClient" />

<add name="WeatherAppDbConnectionString" connectionString="Data Source=(LocalDb)\SQLEXPRESS;;Initial Catalog=WeatherAppDb;Integrated Security=True"
      providerName="System.Data.SqlClient" />

The easiest way would be to delete "Default Connection" connection string and rename your "Weather App DbConnectionString" to "Default Connection", so you would be left with just this

//renamed from WeatherAppDbConnectionString to Default Connection
     <add name="DefaultConnection" connectionString="Data Source=(LocalDb)\SQLEXPRESS;;Initial Catalog=WeatherAppDb;Integrated Security=True"
      providerName="System.Data.SqlClient" />

2. Once you have done first step, just go to your WeatherAppDbEntities and as StormCloack stated make sure you have "Default Connection" here

public class WeatherAppDbEntities : IdentityDbContext<ApplicationUser>
        {
            public WeatherAppDbEntities()
                : base("DefaultConnection")
            {
            }
        }

As far as your code, maybe there could be a problem also but not sure, i've modified a little.

   WeatherAppDbEntities db = new WeatherAppDbEntities();
            var um = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(db));               
            var user = db.Users.Find(username);