CODEWITHSUNDEEP
c#asp.netasp.net-mvcwindows-authenticationauthorize-attribute
ASPNETMVC-Newbie
ASPNETMVC-Newbie

Reputation: 177

ASP.NET MVC Authorize attribute with a parameter

I am beginning to decorate my controller classes with

[Authorize(Roles = @"DOMAIN\ADGroup")]

What would be the best method to change that explicit string to a parameter that collects the role assignment from a database, thus allowing flexibility in role assignment that an Admin area can sit on top off.

For example say I have three roles, for arguments sake

And I want to map those roles to Multiple AD groups

For example

This will be editable, I can modify the mapping from role to any AD group I choose in the Admin area of my application.

How can my Authorize attributes take advantage of this?

Upvotes: 2

Views: 2894

Answers (2)

Christoph Fink
Christoph Fink

Reputation: 23113

You can extend the AuthorizeAttribute class. I did it like the following:

public class ExtendedAuthorizeAttribute : AuthorizeAttribute
{
    protected string permission;
    protected string group;

    public ExtendedAuthorizeAttribute(string Permission, string Group)
    {
        permission = Permission;
        group = Group;
    }

    protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
    {
        var can = PermissionManager.Can(httpContext.User, permission, group);
        if(can.HasValue)
            return can.Value;
        return base.AuthorizeCore(httpContext);
    }
}

Upvotes: 1

Matti Virkkunen
Matti Virkkunen

Reputation: 65176

Make your own role provider that returns a list of your ReadOnly etc roles based on the current user's AD roles. Then you can use the Authorize attribute to refer to those roles instead.

Upvotes: 0

Related Questions