正在使用Windows Authentication建立一个内联网网站。

Maybe I m not going about this the best way, but I m trying to load partial views via calling a controller method that has an Authorize action filter wrapped around it, so that only authorized individuals are able to see that portion of the page. Say, for instance, I wanted to load administrator tools onto the page but only if the logged-in individual is an administrator.

因此,在指数.cshtml网页上,我可能会有以下一些内容:

@Html.Action("LoadAdminTools","ControllerName")

The Controller would contain the code:

        [Authorize(Roles="Admins")]
        public ActionResult LoadAdminTools()
        {
            return PartialView("_AdminToolsPartialView");
        }

And then the partial view containing the admin controls (or whatever) would render to the page - only if the logged-in user was part of the Admins role.

The problem I m having is that if the person logged-in is not authorized to load the partial view, the browser pops up the login dialog asking for the user s credentials. Closing the dialog without inputting any credentials causes the expected results - the partial view doesn t load while the rest of the page does. Cool, but annoying. Input the incorrect credentials and you get a 401 error - also as expected.

If it helps: In IIS, Anonymous Authentication is disabled, Windows Authentication is enabled. "Automatic logon with current user name and password" is selected in Internet Options under "Security Settings - Local Intranet Zone."

My question is this: Is there a way to use the [Authorize] action filter to load a partial view (or to do anything, really) without the browser asking the user to log in? Just have it take the current logged-in credentials, check if they comply with the action filter, if they do, load the partial view, if not, then don t. If there isn t, is there simply a better way of going about what I want to accomplish here?

UPDATE

美丽。 我读到你提出的问题的解决办法,即Mystere Man,在主计长的夹子内设立了一个新班,称为IntranetAuthorizeAttribute.cs,在代码中重新写:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
    public class IntranetAuthorizeAttribute : System.Web.Mvc.AuthorizeAttribute
    {        
        protected override void HandleUnauthorizedRequest(System.Web.Mvc.AuthorizationContext filterContext)
        {
            if (filterContext.HttpContext.Request.IsAuthenticated)
            {
                filterContext.Result = new System.Web.Mvc.HttpStatusCodeResult(403);
            }
            else
            {
                base.HandleUnauthorizedRequest(filterContext);
            }
        }        
    }

授权过滤器改为我的新的内联网网。

        [IntranetAuthorize(Roles="Admins")]
        public ActionResult LoadAdminTools()
        {
            return PartialView("_AdminToolsPartialView");
        }

如今,该网页仅装上no browserlogin dialog - <>>>>。 部分意见: 核准<> /em> 用户和 不含 部分意见:不是经授权的<>/em> 用户=