[Authorize] and NTLM in ASP.Net MVC

Question

If I disable anonymous browsing of an MVC site and only allow NTLM authenticate users access, I presume any page simply decorated with the

[Authorize]

attribute will pass, so if I want to only allow user limited access to parts of the site, I'll need to do add them to an AD group and use that to apply the filter?

Answer 1

[Authorize] by default will only look for IsAuthenticated flag. So yes, applying[Authorize] without additional param will allow all logged in users.

To limit, you can use Roles/Group (NOT OUs). It will check the IsInRole (from IPrincipal).