title: asp.net MVC authentication with Shibboleth
body: <p>Shibboleth is a SSO Authentication that is added to IIS as a &quot;plugin&quot;.
  After a user has done a Login there are Headers showing the Shibboleth Session:
  ShibSessionID
  ShibIdentityProvider
  eppn
  affiliation
  entitlement
  unscopedaffiliation
  ...more</p>
  <p>So i can extract username and roles from the Headers.
  so far so fine.</p>
  <p>Question:
  How can I implement a handler that does read the headers and set the status that a user is authorized?
  Idea is to use the
  [Authorize]
  Attribute and the Method
  Roles.IsUserInRole.
  All from the Headers, no Database, no User Management.</p>
  <h1>Update</h1>
  <h3>Implementation According to the Answer from @Pharylon</h3>
  <p>In this Update there is nothing new, just a help for the copy&amp;past friends.
  Of course you have to adjust the properties and Header fieldnames according to your Shibboleth Setup.</p>
  <p>File: ShibbolethPrincipal.cs</p>
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Security.Principal; //GenericPrincipal
  
  namespace Shibboleth
  {
      public class ShibbolethPrincipal : GenericPrincipal
      {
          public string username
          {
              get { return this.Identity.Name.Replace(&quot;@ksz.ch&quot;, &quot;&quot;); }
          }
  
          public string firstname
          {
              get { return HttpContext.Current.Request.Headers[&quot;givenName&quot;]; }
          }
  
          public string lastname
          {
              get { return HttpContext.Current.Request.Headers[&quot;surname&quot;]; }
          }
  
          public string phone
          {
              get { return HttpContext.Current.Request.Headers[&quot;telephoneNumber&quot;]; }
          }
  
          public string mobile
          {
              get { return HttpContext.Current.Request.Headers[&quot;mobile&quot;]; }
          }
  
          public string entitlement
          {
              get { return HttpContext.Current.Request.Headers[&quot;eduzgEntitlement&quot;]; }            
          }
  
          public string homeOrganization
          {
              get { return HttpContext.Current.Request.Headers[&quot;homeOrganization&quot;]; }            
          }
  
          public DateTime birthday
          {
              get
              {
                  DateTime dtHappy = DateTime.MinValue;
                  try
                  {
                      dtHappy = DateTime.Parse(HttpContext.Current.Request.Headers[&quot;dateOfBirth&quot;]);
                  }
                  finally
                  {                    
                      
                  }
  
                  return dtHappy;
              }
              set {}
          }
          
          public ShibbolethPrincipal()
              : base(new GenericIdentity(GetUserIdentityFromHeaders()), GetRolesFromHeader())
          {
          }
  
          public static string GetUserIdentityFromHeaders()
          {            
              //return HttpContext.Current.Request.Headers[&quot;eppn&quot;];            
              return HttpContext.Current.Request.Headers[&quot;principalName&quot;];                        
          }
  
          public static string[] GetRolesFromHeader()
          {
              string[] roles = null;
              //string rolesheader = HttpContext.Current.Request.Headers[&quot;affiliation&quot;];
              string rolesheader = HttpContext.Current.Request.Headers[&quot;eduzgEntitlement&quot;];
              if (rolesheader != null)
              {
                  roles = rolesheader.Split(';');
              }
              return roles; 
          }
      }
  }
  </code></pre>
  <p>File: ShibbolethController.cs</p>
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Web.Mvc;
  
  namespace Shibboleth
  {
      public class ShibbolethController : Controller
      {
          protected new ShibbolethPrincipal User
          {
              get
              {
                  return (base.User as ShibbolethPrincipal) ?? null; //CustomPrincipal.GetUnauthorizedPrincipal();
              }
          }
      }
  }
  </code></pre>
  <p>File: Global.asax</p>
  <pre><code>void Application_PostAuthenticateRequest(object sender, EventArgs e)
          {
              var ctx = HttpContext.Current;
  
              var principal = new ShibbolethPrincipal();
              HttpContext.Current.User = principal;            
          }
  </code></pre>
  <p>Using examples:</p>
  <pre><code> namespace itservices.Controllers
      {
          [Authorize] //examples : [Authorize(Roles=&quot;Administrators&quot;)], [Authorize(Users=&quot;Alice,Bob&quot;)]
          public class PasswordMailController : ShibbolethController
          {
  
    
  </code></pre>
  <hr />
  <pre><code>    if(User.IsInRole(&quot;staff&quot;))
      {
  </code></pre>