title: How can I manually check the url authorization in MVC5?
body: <p><strong>IIS-Manager</strong></p>
  
  <p>To restrict the access to an web app, an Administrator is able to set the url authorization of users and groups via the IIS-Manager:</p>
  
  <p><a href="https://i.stack.imgur.com/jJFvf.png" rel="noreferrer"><img src="https://i.stack.imgur.com/jJFvf.png" alt="IIS Autohrization Rules"></a></p>
  
  <p><strong>Web.config</strong></p>
  
  <p>The IIS-Manager stores the Authorization Rules in the web.config of the app:</p>
  
  <pre><code>&lt;security&gt;
    &lt;authorization bypassLoginPages="true"&gt; 
      &lt;remove users="*" roles="" verbs="" /&gt;
      &lt;add accessType="Allow" users="Testuser" /&gt;
      &lt;add accessType="Deny" users="*" /&gt; 
    &lt;/authorization&gt;
  &lt;/security&gt;
  </code></pre>
  
  <p>When <code>bypassLoginPages</code> is set to <code>true</code>, all users are authorized to access the login page. When an user is not logged in, he will automatically be redirected to the login page:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms [...] loginUrl="~/Auth/Login" [...] &gt;
      [...]
    &lt;/forms&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p><strong>MVC5 App:</strong></p>
  
  <p>The user has to login in via an custom login page by his Windows SamAccountName and password. The credentials will be sent to the <code>Login</code> action of the <code>AuthController</code>:</p>
  
  <pre><code>[AllowAnonymous]
  public class AuthController : Controller
  {
      public ActionResult Login
      {
          // validation of SamAccountName and Password against Active Directory here.
  
          [...]
  
          // We want to check the authorization here.
  
          // create authentication ticket
          FormsAuthenticationTicket lFormsAuthenticationTicket = new FormsAuthenticationTicket(1,
              SamAccountName,
              DateTime.Now,
              DateTime.Now.AddMinutes(AuthCookieTimeout),
              RememberMe,
              CustomData,
              FormsAuthentication.FormsCookiePath);
  
          // Encrypt the ticket.
          string lEncryptedTicket = FormsAuthentication.Encrypt(lFormsAuthenticationTicket);
  
          var lAuthCookie = new HttpCookie(FormsAuthentication.FormsCookieName, lEncryptedTicket);
  
          // Create the cookie.
          Response.Cookies.Add(lAuthCookie);
  
          [...]
  
          return RedirectToAction("Index", "Main"); // redirect to the main controller
      }
  }
  </code></pre>
  
  <p>All restricted controllers are making the authorization check via the <code>[Authorize]</code> attribute automatically:</p>
  
  <pre><code>[Authorize]
  public class MainController : Controller
  {
      [...]
  }
  </code></pre>
  
  <p>An decoration like <code>[Authorize(Users="User1,User2")]</code> is no solution because the code is not accessible by the Endusers which should have the possibility to configurate the access to the app.</p>
  
  <p>When a user is not authorized, then he will be redirected to the login page. That works fine. But I need to make the authorization check in the <code>Login</code> action before. So my question:</p>
  
  <p>How can I manually validate in my <code>AuthController</code> if the logged in user is authorized to redirect to the <code>MainController</code>?</p>