使用ClaimsAuthorizationManager在MVC4中忽略AllowAnonymous属性

Question

我正在尝试使用自定义ClaimsAuthorizationManager基于Dominic Baier在一个新的MVC4应用程序中的出色工作，该应用程序仍然非常基于开箱即用的Internet模板，当我配置它似乎想要授权一切并忽略[AllowAnonymous]属性。

看看堆栈跟踪似乎是ExtensionlessUrlHandler-Integrated-4.0触发了AuthorizationManager代码。

我觉得这是我web.config的配置问题（见下文），或者我的AuthorizationManager中需要一些额外的逻辑，以便当时不执行检查。

我的完整性是Controller代码段：

    [AllowAnonymous]
public class HomeController : Controller
{
    [AllowAnonymous]
    public ActionResult Index()
    {
        ViewBag.Message = "Modify this template to jump-start your ASP.NET MVC application.";

        return View();
    }

system.web部分：

<system.web>
  <compilation debug="true" targetFramework="4.5" />
  <httpRuntime targetFramework="4.5" />
  <authorization>
    <!--<deny users="?" />-->
  </authorization>
  <authentication mode="Forms">
    <forms loginUrl="~/Account/Login" timeout="2880" />
  </authentication>
  <roleManager enabled="true" defaultProvider="simple">
    <providers>
      <clear />
      <add name="simple" type="WebMatrix.WebData.SimpleRoleProvider,WebMatrix.WebData" />
    </providers>
</roleManager>
<membership defaultProvider="simple">
    <providers>
      <clear />
      <add name="simple" type="WebMatrix.WebData.SimpleMembershipProvider,WebMatrix.WebData" />
    </providers>
</membership>
<pages>
  <namespaces>
    <add namespace="System.Web.Helpers" />
    <add namespace="System.Web.Mvc" />
    <add namespace="System.Web.Mvc.Ajax" />
    <add namespace="System.Web.Mvc.Html" />
    <add namespace="System.Web.Optimization" />
    <add namespace="System.Web.Routing" />
    <add namespace="System.Web.WebPages" />
  </namespaces>
</pages>
<httpModules>
  <!--WIF 4.5 modules -->
  <!--Not needed here for IIS >= 7 -->
  <!--<add name="ClaimsAuthorizationModule" type="System.IdentityModel.Services.ClaimsAuthorizationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>-->
</httpModules>

system.webServer部分：

<system.webServer>
  <validation validateIntegratedModeConfiguration="false" />
  <handlers>
    <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
    <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
    <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
    <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
    <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
    <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
  </handlers>
  <modules runAllManagedModulesForAllRequests="false">
    <remove name="RoleManager" />
    <remove name="FormsAuthentication" />

    <!--WIF 4.5 modules -->
    <add name="ClaimsAuthorizationModule" type="System.IdentityModel.Services.ClaimsAuthorizationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
    <add name="ClaimsTransformationModule" type="HillIntl.MyLCM.Security.ClaimsTransformationHttpModule" />

    <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
</modules>

身份模型部分：

<!--WIF 4.5 s.im section-->