c# - Role-Based Access Control to a User -

i have application mvc 4.0 using entity framework.

i have user table, role table, type table.

role can out of two: administrator, user

type can out of 8: none, admin, asst.admin, ......

so want allow different pages accessed based on type below:

1) types defined:

none    con     acc     rec     st      fr      admin  asad  ( <-- types) ---------------------------------------------------------- 

1.a) update client:

none    none    none    none    edit    view    full  full  ( <-- roles) 

1.b) new client:

none    none    none    view    view    edit    full  full  ( <-- roles) 

so how achieved ?

you can achieve authorizeattribute:

[attributeusage(attributetargets.class | attributetargets.method)] public sealed class actionpermissionattribute : authorizeattribute {     public override void onauthorization(authorizationcontext filtercontext)     {         var controllername = filtercontext.actiondescriptor.controllerdescriptor.controllername;         var actionname = filtercontext.actiondescriptor.actionname; 

add attribute actions need have authorised - add @ controller makes easier or create base controller inherits controller , inherit controllers that.

you can store controller+action vs role in db

        // allowed groups controller+action database (cache this)         // ad groups current user in (or db etc)         var usergroups = httpcontext.current.request.logonuseridentity.groups                          .translate(typeof(system.security.principal.ntaccount))         // check if user in in required group  

if want have permissions defined in code per action, add properties attribute , attribute constructor required.

i didn't understand role vs type, in mvc action (method) lock down individual actions (there's no 'edit' action called 'edit').