Authentication and Authorization in MVC Projects Using RavenDb

I’ve been getting a huge kick lately out of getting familiar with RavenDb. I’m just starting out, so there’s no doubt plenty I’m doing wrong and plenty that I’m not yet aware of by way of best practice. All the same, this “NoSQL” database is built specifically with the .Net framework in mind and it is just a pile of fun to play with.

When I’m building a new ASP.Net MVC site one of the most common things I’ll want to do is implement some degree of security. That is, authentication and authorization. Normally when you create a new web application the Visual Studio template will put together an application database, an AccountController and everything else that goes along with the Membership Provider. The trouble is that apart from likely being more clout than I need for a simple application, the existing .Net Membership Provider is a poor fit for RavenDb.

Microsoft’s Forms Authentication model works well for most situations. In a nutshell, all this is doing is writing a cookie for your application that confirms that a given user is indeed authenticated. This is available on every page request and I don’t really see a need to completely re-write the implementation for this. The Membership Provider deals with how users’ details and their passwords are stored and the validation of those users’ credentials. There are a huge number of methods and features available in this provider model that from a practical point of view become inefficient or downright annoying to recreate in a custom membership provider and I’m inclined not to use it.

I’m not the only one who thinks so. There are a couple of pretty good alternative membership provider solutions available for RavenDb although my preference is probably this one by Jonas Gauffin due to its cut-down and minimal implementation. The other resource I’ve linked to here is also very thorough and works well; YMMV.

For anyone wanting to roll their own auth code, there are two bundles provided by the RavenDb project: Authorisation and Authentication. The Authentication bundle is particularly useful if you plan on integrating an OAuth facility into your project. Ayende discusses this further in this YouTube video which also touches briefly on basic authentication principles with RavenDb.

Users

The RavenDb bundles deal with AuthenticationUser and AuthorizationRole objects / classes. Typical usage for an application user looks like this:

            using (IDocumentSession Session = DataDocumentStore.Instance.OpenSession())
            {
                Session.Store(new AuthenticationUser
                {
                    Name = Email,
                    Id = String.Format("Raven/Users/{0}", Name),
                    AllowedDatabases = new[] { "*" }
                }.SetPassword(Password));
                Session.SaveChanges();

                return Session.Load(String.Format("Raven/Users/{0}", Name));
            }

This creates a new user in the RavenDb database. You would pass in the values for Email, Name and Password and Raven takes care of the rest. The AuthenticationUser class has a convenient method for validating a user’s existence and password, named ValidatePassword():

                using (IDocumentSession Session = DataDocumentStore.Instance.OpenSession())
                {
                    return Session.Load(String.Format("Raven/Users/{0}", Username)).ValidatePassword(Password);
                }

This returns a boolean in exactly the same way as calling Membership.ValidateUser() in conventional Forms Authentication.

Roles

Role management looks somewhat more foreign for users who are only accustomed to native .Net implementations. At its simplest, a new role is added in the following way:

                    Session.Store(new AuthorizationRole
                    {
                        Id = String.Format("Authorization/Roles/{0}", Name),
                        Permissions = {
                            new OperationPermission
                            {
                                Allow = true,
                                Operation = "*"
                            }
                        }
                    });

                    Session.SaveChanges();

The role name is passed in with the variable Name in the example above. Users are added to roles in a similar manner:

                Session.Store(new AuthorizationUser
                {
                    Id = String.Format("Authorization/Users/{0}", UserId),
                    Name = UserId,
                    Roles = Roles.Select(rl => String.Format("Authorization/Roles/{0}", rl)).ToList(),
                    Permissions = 
                    {
                        new OperationPermission
                        {
                            Allow = true,
                            Operation = "*"
                        }
                    }
                });

                Session.SaveChanges();

Again, the UserId and a list of roles to add that user to (passed in as List Roles in the example) are provided to the method.

Roles also use a concept of tags, which in an MVC setting are well suited to ActionResult methods but might contain any such information the developer deems fit. The tags form part of the OperationPermission object that is included in the AuthorizationRole and AuthorizationUser objects. For example:

        public static void Add(string Name, List Tags)
        {
            using (IDocumentSession Session = DataDocumentStore.Instance.OpenSession())
            {
                if (Session.Load(String.Format("Authorization/Roles/{0}", Name)) == null)
                {
                    Session.Store(new AuthorizationRole
                    {
                        Id = String.Format("Authorization/Roles/{0}", Name),
                        Permissions = {
                            new OperationPermission
                            {
                                Allow = true,
                                Operation = "Cars/Add",
                                Tags = Tags
                            }
                        }
                    });

                    Session.SaveChanges();
                }
            }
        }

What this is actually doing is to secure the individual documents (i.e. the entities in the database) by providing a mechanism for matching tags within each document to actions performed on their documents. Read the RavenDb documentation here for a clear description of how it can be made to work.

It should be pointed out you don’t have to go to this level of granularity for a basic MVC site. It is quite acceptable to create a set of Roles, then add AuthorizationUser records whose roles are defined as part of the record. RavenDb is quick and easy enough that you could just as easily call the user, find that user’s roles then match those against whatever role you have decorated your ActionResult with.

Overriding the Authorize attribute in MVC couldn’t be much easier:

    public class AuthenticateAttribute : AuthorizeAttribute
    {
        IDocumentSession DocumentSession;

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            using (DocumentSession = DataDocumentStore.Instance.OpenSession())
            {
                try
                {
                    var user = DocumentSession.Load(String.Format("Raven/Users/{0}", HttpContext.Current.User.Identity.Name));
                    return DocumentSession.Load(user.Id.Replace("Raven", "Authorization"))
                        .Roles.Contains("Authorization/Roles/Administrators");
                }
                catch (NullReferenceException)
                {
                    return false;
                }
            }
        }
    }

Now I can decorate my methods using this syntax:

        [Authenticate(Roles="Administrators")]

RavenDb doesn’t require a lot of heavy lifting and basic operations are ridiculously easy and even fun to work with. I’m still finding my way around the best approach to certain problems but I’m finding that the simplicity of the framework is such that even mistakes are enjoyable learning opportunities.

If you’d like to learn more about RavenDb there’s an excellent TekPub series on the subject at http://tekpub.com/productions/raven