Access denied for [Authorize(Roles = "Administrators")] using Windows Authentication

Question

I have an ASP.NET MVC 4 site that uses Windows Authentication to restrict user access. On the controller [Authorize(Roles = "Administrators")] is applied.

The site is running on my local machine from IIS. When accessing the site (also from my local machine) access is denied, even though my user account is member of the administrator group.

I've tried specifying the "BUILTIN\Administrators" as suggested in this post: How do I make AuthorizeAttribute work with local Administrators group in ASP.NET MVC 3 intranet application? but without success.

If I create a new group like "TestGroup", assign my user account to the group and use [Authorize(Roles = "TestGroup")] on my controller - I'm then able to gain access to the controller.

Is there some special restriction on the Administrator group (for security reasons maybe?), or is there anything else that could influence the use of the Administrator group?

Answer 1

By listing the Claims inside your current ASP.NET Identity:

(System.Web.HttpContext.Current.User.Identity
    as System.Security.Principal.WindowsIdentity)
    .Claims
    .ToArray();

you will see that for the Administrators group (SID: S-1-5-32-544) there is a claim of type denyonlysid. The call to User.IsInRole("Administrators") will then fail.

The whole point, I think, is that the current user is never truly part of the Administrators group, unless you turn off UAC and/or run your browser as an administrator.

I have done both those things (browser is Firefox with NTLM enabled on localhost) and ta-dah, everything works as expected:

System.Web.HttpContext.User.IsInRole("Administrators")  
true
(System.Web.HttpContext.User.Identity
    as System.Security.Principal.WindowsIdentity)
    .Claims
    .ToArray()
{System.Security.Claims.Claim[19]}
[0]: {http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: Domain\Mauro}
[...]
[8]: {http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid: S-1-5-32-544}

As an end note, you should not use the Administrator group for claims based authentication. Better to introduce custom domain/local groups.

Just my 2 cents.